Lifestyle Therapy & Coaching

The covered entity (CE), Lifestyle Therapy & Coaching, updated its website on June 16, 2017, inadvertently leaving an electronic form that could be used to search the CE’s client directory unsecured. A former client notified the CE of this problem on August 13, 2017, and the CE immediately secured the client information. The exposed directory contained names, addresses, telephone numbers, and email addresses for 551 individuals. In response to the breach and OCR's investigation, reviewed its safeguards for electronic protected health information, implemented additional access controls, and revised training procedures. The CE provided breach notification to HHS, affected individuals, the media and on its website. OCR obtained assurances that the CE implemented the corrective actions listed above.