LC&Z General and Cosmetic Dentistry

On May 17, 2017, LC&Z General and Cosmetic Dentistry, the covered entity (“CE”), discovered it had experienced a breach when an unauthorized individual gained access to the CE’s email account, potentially exposing the names, dates of birth, addresses, email addresses, phone numbers, social security numbers, clinical and health insurance information of 4,391 individuals. The CE provided timely breach notification to HHS, to the affected individuals and to the media, and posted substitute notice on its website. At the time of the incident, the CE did not have a business associate (BA) agreement in place with its email service provider. In response to the breach, the CE entered into a BA agreement with the email service provider, implemented additional security measures to its email system, implemented a more secure platform to communicate with patients and transmit protected health information, and retrained its workforce on its HIPAA policies and procedures. OCR obtained assurances that the CE implemented the corrective actions listed above.