Luque Chiropractic

On September 18, 2016, a business associate (BA), EMR4all Inc., notified the covered entity (CE), Luque Chiropractic, Inc., that the BA’s Amazon "S3" storage account was subject to unauthorized access. The breach affected the protected health information (PHI) of approximately 1,341 individuals and included patients’ names, dates of birth, treatment locations, treatment dates, social security numbers, driver’s license numbers, and diagnoses. The CE provided breach notification to affected individuals, the media, and HHS. The CE also provided free credit monitoring for affected individuals. The CE terminated its business relationship with the BA and revised its HIPAA policies and procedures. OCR provided substantial technical assistance to the CE and obtained assurances that the CE implemented the corrective actions noted above.