Patients Choice

On November 19, 2016, an individual hacked into the covered entity’s (CE) file transfer (FTP) computer server, stole documents, and subsequently reported the incident to the CE and OCR. The types of protected health information (PHI) involved in the breach incident included demographic, financial, and clinical information. In response to the breach incident, the CE implemented additional technical safeguards, including encryption and firewall protection. Further, the CE stopped using FTP servers, updated its Privacy and Security policies and procedures, conducted an updated risk analysis, and implemented a corresponding risk management plan. OCR obtained assurances that the CE implemented these corrective actions.