Silverberg Surgical and Medical Group

The covered entity (CE), Silverberg Surgical and Medical Group, reported that a business associate (BA), misconfigured its document scanning device allowing scanned records to be accessible via the Internet. The breach affected approximately 857 individuals. The protected health information (PHI) involved included names, addresses, dates of birth, phone numbers, email addresses, medical information, medical record numbers, health plan information, social security numbers, state license numbers, and full face photographic images. The CE provided breach notification to HHS, the affected individuals, and the media. The CE also revised its policies and procedures, retrained workforce members, provided all affected individuals with credit monitoring and identity theft consultation services, and implemented a dedicated call center to assist affected individuals.