Midwest Orthopedic Pain and Spine

The covered entity (CE), Midwest Orthopedic, reported that it learned of a breach when notified by the Federal Bureau of Investigation (FBI) on May 27, 2016. Based on the information provided by the FBI the CE believes that the weakness or vulnerability that lead to the breach may have been a third party company that had access to the database for patient record transferring purposes. This breach affected the protected health information (PHI) of 29,153 individuals and included names, addresses, dates of birth, social security numbers, driver’s license numbers and clinical information. The CE provided breach notification to HHS, affected individuals, and the media. To resolve the issues raised in this matter, the CE changed the companies it uses for information technology, billing and electronic medical records. The new information technology company implemented new internet firewalls and began continuous monitoring of the CE's computer server for unauthorized access to electronic PHI and malware. The CE also retrained staff on HIPAA. OCR obtained documented assurances that the CE implemented the corrective action steps listed above..