Midlands Orthopaedics

On September 15, 2015, the covered entity (CE), Arcis Healthcare, LLC d/b/a Midlands Orthopaedics, discovered that an unknown party identified as “Slyhacker” accessed a patient database. The database contained the names, addresses, and phone numbers of 3,902 individuals. The database was housed on a third party internet site by the CE’s business associate, PlanetHosting.com, The CE provided breach notification to HHS, affected individuals, and the media. In response to the breach, the CE removed the database from the internet-based computer server, hired a digital forensics firm to investigate, and implemented a plan for securing this and other databases containing protected health information. OCR obtained assurances that the CE implemented the corrective actions listed above.