University of Maryland, Baltimore

The business associate (BA), University of Maryland, Baltimore, reported that its vendor experienced a cyber-attack that affected the protected health information (PHI) of approximately 37,263 individuals. The PHI involved included names, dates of birth, addresses, claims information, diagnoses and conditions, lab results, medications prescribed, and other treatment information. The BA notified HHS, affected individuals, the media, and provided substitute notice. In response to the breach, the BA strengthened its technical safeguards to better protect PHI.