Toth Enterprises II

The covered entity (CE), Toth Enterprises II d/b/a Victory Medical, learned that an unidentified person uploaded a paper-based report onto a third-party website without the knowledge or authorization of the CE. The report contained the protected health information (PHI) of 2,000 individuals and included patients’ demographic information and medical account numbers. The CE provided breach notice to HHS, affected individuals, and the media. Following the breach, the CE conducted a new risk analysis, developed a new risk management plan, implemented improved administrative safeguards, developed new policies, and retrained staff. OCR obtained documented assurances that the CE implemented these correction actions.