Medical Information Management Systems

A business associate (BA), Medical Information Management Systems, LLC (MIMS), a Sheridan Healthcorp, Inc. subsidiary, was part of the electronic network at Valley Anesthesiology and Pain Consultants (VAPC), which suffered a cyberattack when a third party may have gained unauthorized access to the network, including the BA’s computer server(s) on March 30, 2016. VAPC discovered the incident on June 13, 2016, and identified the MIMS server that may have been compromised on July 22, 2016. MIMS was a BA of First Assistant Associates (FAA) at the time, providing billing and collection services. The incident compromised not only electronic protected health information (ePHI) at VAPC, but also ePHI regarding 11,707 individuals in the MIMS server who were FAA patients. OCR opened a separate review of the VAPC breach. The types of ePHI that were potentially accessed in the MIMS server included patient names, dates of birth, addresses, health insurance information, clinical information, and some social security numbers. In response to the breach, MIMS/VAPC installed a virtual privacy network (VPN) device to improve the security of remote access to the network and disabled the compromised ne