A student employee used an online open source programming tool, GitHub, to program a data transfer, but failed to label his programming as private. This exposed the protected health information of 5,292 individuals online for more than a year until the covered entity (CE) discovered it on April 29, 2017. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE updated its Security Rule Risk Management Plan, implemented periodic technical and nontechnical evaluations, and retrained its workforce members. OCR obtained documented assurances that the CE implemented the corrective actions listed.
