M&M Computer Services

An unknown third party intruder hacked into a server of a business associate (BA) which maintained electronic health records for the covered entity (CE), Penn Highlands Brookville. The breach potentially affected the protected health information (PHI) of 4,500 individuals and included names, dates of birth, social security numbers, and clinical information. The CE provided breach notification to HHS, affected individuals, and the media, and offered affected individuals one year of credit monitoring. Following the breach, the CE terminated its relationship with the BA. OCR initiated a compliance review of the BA in July of 2015, but learned that it was no longer doing business or acting as a BA. As a result of OCR’s investigation, the CE developed a checklist to use to ensure that electronic health record systems used by medical practices acquired by the CE comply with the HIPAA Privacy and Security Rules and to ensure that proper BA agreements are in place.