Wells Pharmacy Network

On August 10, 2018, the covered entity (CE), Wells Pharmacy Network, submitted a breach report that identified several security concerns and a possible IT security incident. In response to OCR’s investigation, the CE investigated and determined that the alleged incident was a temporary decrease in server speed due to an incorrectly scheduled data transfer between the CE’s operating system and its sales management platform and there no evidence of a breach. However, in response to the IT manager’s concerns and OCR’s investigation, the CE migrated to software that allowed for encryption of electronic communications, developed and implemented new privacy and security policies and procedures, and updated its HIPAA training program. OCR provided technical assistance related to the Security Rule requirement for risk analyses and obtained assurances that the CE implemented the voluntary corrective actions listed above.