Reimbursement Technologies

An employee of the covered entity (CE), Reimbursement Technologies, Inc., impermissibly accessed the check images of approximately 2,300 patients. The protected health information (PHI) involved in the breach included personal check information, including bank routing numbers, names and addresses. Following the breach, the CE terminated the employee and reported the breach to the FBI for further investigation. The CE reviewed all the check images accessed and notified the guarantors and offered credit monitoring. The CE monitored employee check viewing, further identified vulnerabilities, and updated its HIPAA policies and procedures, including requiring the check imaging vendor to truncate bank routing numbers. The CE also improved safeguards by installing a new firewall. OCR obtained assurance that the covered actions listed above were completed.