MDeverywhere

MDeverywhere, a subcontractor, established an electronic message board to facilitate communications with a business associate (BA), Continuum Health Alliance, LLC, about billing and insurance claims for patients of the covered entity (CE), Advocare, LLC. The message board was unsecured and accessible to internet users without prompting the user for a username or password, affecting 1,396 individuals' protected health information (PHI), including names, insurance information, dates of birth, and clinical information and a small number of social security numbers. Following the breach, the subcontractor disabled the message board and requested it be deleted from the free website. Additionally, the subcontractor deleted all of the message board backups and provided retraining to all of its workforce. The retraining included the prohibition of using free websites, downloading unauthorized software, and disciplinary actions for violating its policies. The CE provided breach notification to HHS, affected individuals, and the media. OCR reviewed the subcontractors’ risk analysis and risk management and provided technical assistance regarding the requirements of the Security Rule.