Professional Counseling & Medical Associates

The covered entity (CE), Professional Counseling & Medical Associates, discovered that a former contractor workforce member accessed the CE’s electronic health records system after her employment ended on May 12, 2017. The former contractor was able to access the protected health information (PHI) of 2,605 individuals, including names, addresses, dates of birth, driver’s license numbers, patient ID numbers, claims information, diagnoses, lab results, medications, and treatment information. The CE provided breach notification to HHS, affected individuals, the media, and on its website. Following the breach, the CE improved several of its safeguards, including changing password requirements, revising workforce termination procedures, strengthening its firewall, conducting more frequent system reviews, improving physical security, and providing additional HIPAA training to staff. OCR obtained assurances that the CE implemented the corrective actions listed above.