The covered entity (CE), SummaCare, reported that an authentication misconfiguration in its computer systems allowed documents containing the protected health information (PHI) of 716 individuals to be accessible via the internet. The PHI involved included names, member identification numbers, diagnoses, financial information, and other treatment information. The CE notified HHS, affected individuals, and the media. In response to the breach, the CE implemented additional administrative and technical safeguards to better protect its PHI.
