Suburban Lung Associates

The covered entity (CE), Suburban Lung Associates, reported that its business associate (BA) left medical records unattended which affected 2,984 individuals. The protected health information (PHI) involved included names, addresses, dates of birth, phone numbers, Social Security numbers, diagnoses, and other treatment information. The CE notified HHS, affected individuals, and the media. In its mitigation efforts, the BA implemented additional administrative and technical safeguards to better protect PHI. OCR obtained assurances that the BA implemented the corrective actions noted.