Pulmonary Specialists of Louisville, PSC

On September 26, 2017, Pulmonary Specialists of Louisville, PSC, the covered entity (CE), discovered that an unauthorized third party had impermissibly accessed its electronic health record (EHR) system, affecting 32,000 individuals. The EHR system contained protected health information (PHI), including names, addresses, telephone numbers, dates of birth, Social Security numbers, health insurance information, and health diagnoses and conditions. In response to the breach, the CE disabled the open computer port that was the source of the foreign connection, rebuilt its file system, transferred to a cloud-based fully encrypted EHR system and ultimately migrated to a cloud-based server. As a result of OCR’s investigation, the CE created and/or revised its policies on information systems activity review, access controls, user authentication, unique user ID, and contingency plans. OCR provided the CE with technical assistance on the Breach Notification Rule and workforce training requirements and documentation. The CE provided breach notification to HHS, affected individuals, and the media. OCR obtained assurances that the CE implemented the corrective actions listed above.