Rural Health Access

Rural Health Access Corporation DBA Coalfield Health Center, the covered entity (CE), reported that its business associate (BA), Quality Insights, was sharing protected health information (PHI) as part of a quality improvement program with the WV Department of Health and Human Resources Bureau for Public Health. The CE discovered that the PHI was uploaded without being de-identified. The CE also discovered that there was no business associate agreement between Quality Insights and the WV Department of Health and Human Resources Bureau for Public Health. This breach affected 874 individuals and the PHI involved included names, addresses, and treatment information. Of note, the PHI was destroyed by the recipient. The CE notified HHS, affected individuals, and the media.