RightNow Technologies

RightNow Technologies, the software vendor and business associate (BA) for the covered entity (CE), MDwise, failed to disable a software switch, which allowed Google to index files on the CE’s hosted website containing the electronic protected health information (ePHI) of approximately 2,700 individuals. The ePHI included individuals’ names, addresses, zip codes, Medicaid numbers, and primary care physicians’ names and addresses. Following the breach, the CE took down the files in issue, disallowed the indexing and searching of the CE’s files by Internet search engines, and added restrictions. The CE also requested that Google remove the indexing on the affected files and obtained confirmation that Google cooperated within 24 hours. The CE provided breach notification to HHS, affected individuals, and the media. Finally, the CE improved technical safeguards pursuant to the HIPAA Security Rule. OCR obtained assurances that the CE implemented the corrective actions listed.