Physician Associates

On August 7, 2017, the covered entity (CE), Physicians Associates, discovered that its medicine manufacturer’s (DePuy Synthes Mitek Sports Medicine) website vendor, CoPilot Provider Support Services (CoPilot), experienced a breach in October 2015, when a former CoPilot employee accessed the CE’s patients' protected health information (PHI). This PHI included the names, addresses, telephone numbers, dates of birth, genders, medical insurance card information, and Social Security numbers of approximately 710 individuals. The CE provided breach notification to HHS and CoPilot provided notification to affected individuals and the media on behalf of the CE. In response to the breach, the CE ceased using CoPilot as a vendor. The CE re-educated its leadership on business associate (BA) agreements. The CE now reviews vendor lists on a monthly basis to ensure that appropriate BA agreements are in place. OCR provided technical assistance to the CE regarding BAs. OCR obtained assurances that the CE implemented the corrective actions listed above.