SOUTHERN MARYLAND MEDICAL GROUP

Southern Maryland Medical Group, LLC, the covered entity (CE), reported that during a two month period the protected health information of individuals was exposed when its business associate (BA), Meditab, inadvertently removed the authentication methods for secure access to its fax cloud service portal. The breach involved the protected health information (PHI) of 1,400 individuals. The types of PHI involved included medical records, names, addresses, dates of birth, phone numbers, Social Security numbers and account numbers. The CE obtained proof that its BA had rectified the cause of the breach. The CE notified the affected individuals, published notice in the media, and posted notice on its website. Additionally, the CE adopted HIPAA Privacy and Security Rule policies and procedures and trained its staff. As a result of its investigation, OCR obtained assurances that the CE implemented the corrective actions noted above.