Longwood Orthopedic Associates

The covered entity (CE), Longwood Orthopedic Associates, disclosed protected health information (PHI) to a printing vendor, Fenway Printing Group, without first executing a business associate (BA) agreement. The breach included the names, addresses, and medical record numbers of approximately 10,000 individuals. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE ensured that the BA securely destroyed the PHI, executed a BA agreement with Fenway, and reviewed all of its existing vendors to ensure the existence of executed BA agreements where necessary. In addition, the CE reviewed and revised its HIPAA training program. OCR obtained assurances that the CE implemented the corrective action steps noted above.