Southeast Eye Institute

Bizmatics, the covered entity (CE), was the victim of a cyber-attack that affected the protected health information (PHI) of approximately 3,156 patients of Bay Area Children’s Association, California Health and Longevity Institute, and possibly other business associates (BA) of the CE. The type of protected health information (PHI) involved included names, addresses, dates of birth, Social Security numbers, clinical information diagnoses/conditions, lab results, medications prescribed, and other treatment information. As a result of OCR’s investigation, Bizmatics engaged with a cybersecurity firm and implemented additional administrative, technical, and security safeguards to better protect its PHI. Bizmatics also retrained its staff on security measures and the importance of protecting patient privacy. OCR obtained assurances that Bizmatics implemented the corrective actions noted.