MedEvolve

Today, the U.S. Department of Health and Human Services’ Office for Civil Rights (OCR) announced a settlement with MedEvolve, Inc. (“MedEvolve”), a business associate that provides practice management, revenue cycle management, and practice analytics software services to health care entities. The settlement was signed to resolve a data breach resulting from the misconfiguration of a File Transfer Protocol (“FTP”) server that caused the protected health information of 230,572 individuals to be unsecure and accessible on the internet. The potential violations of the Health Insurance Portability and Accountability Act (HIPAA) include the lack of an analysis to determine risks and vulnerabilities to electronic protected health information across the organization, and the failure to enter into a Business Associate Agreement with a subcontractor. As a result MedEvolve paid $350,000 to OCR and agreed to implement a corrective action plan, which identifies steps MedEvolve will take to resolve these potential violations and protect the security of electronic patient health information. “Ensuring that security measures are in place to protect electronic protected health information where it