Integrated Rehab Consultants

On December 2, 2016, a health care researcher notified the covered entity (CE), Integrated Rehab Consultants, that its data was present on an online public repository, Github. Upon investigation, the CE determined that its vendor, TrueRCM, provided the data to another third-party vendor, Magnum, who then inadvertently uploaded the data to Github. The CE believed that the access to the data was limited to the health care researcher who reported the incident to IRC. However, in the fall of 2017, the CE discovered that the data had been accessed by at least one additional party. The CE continued its investigation of the incident and ultimately determined that it could not conclusively rule out unauthorized access to the data by other third parties. The breach affected 4,292 individuals. The protected health information involved in the breach included demographic and clinical information. The CE provided breach notification to HHS, affected individuals, and the media and posted substitute notice on its website. The CE responded to the breach by working with Magnum to remove the data from the Github repository and confirming that TrueRCM terminated its service relationship with Magnum.