Neurology Physicians

The covered entity (CE), Neurology Physicians, reported that in February, 2010, it entered into a medical transcription services agreement with a business associate (BA) located in Bangalore, India that provides dictation and transcription services for the physicians. On May 23, 2016, a patient discovered the office notes from her visit were viewable online. The CE learned that the transcribed files were uploaded onto a public Hypertext Markup Language (HTML) folder that was publicly searchable. The breach affected 4,831 individuals and included clinical information. The CE does not have any evidence that transcription files were actually viewed or acquired by any third parties; however, it acted in an abundance of caution in response to the breach due to the potential that the transcription files became publicly searchable at some point between 2010 and 2016, and the inability to determine if any third parties may have viewed the transcription files. To the best of the CE's knowledge, only the two patients who discovered the breach and the individuals involved in the investigation and remediation of the breach on behalf of the CE actually viewed any PHI and did not retain it. OCR