NEA Baptist Clinic

An unknown individual hacked into a database that contained electronic protected health information (ePHI) of individuals who had registered online with the covered entity (CE) in the last eight years. The PHI involved in the breach, which affected approximately 3,116 patients, included names, addresses and dates of birth. The CE provided breach notification to HHS and affected individuals. Following this breach, the CE shut down its “old” website and replaced it with a “new” website with improved safeguards such as blocking of specific IP addresses, strong authentication for areas that are not available to the general public, and secure web browsers. As a result of OCR’s investigation, the CE created new procedures to protect ePHI, including procedures for inventory and asset management, as well as tracking encrypted devices.