Western Pathology

On May 15, 2019, the covered entity (CE), Western Pathology, received notification from its business associate (BA), American Medical Collection Agency, that the BA had discovered a potential data security incident, but it was too early to say what information may have been affected. Upon initial review, the CE reported that 4,079 individuals were affected, and it later amended its report to indicate 4,412 affected individuals. The types of protected health information affected by the breach included demographic and clinical information. The CE provided breach notification to HHS, affected individuals, and the media. In response to the breach, the CE ceased using this BA for collection efforts and informed affected individuals that payments for outstanding balances should no longer be made to the BA. The CE cooperated with OCR’s investigation and provided all requested documents and information to demonstrate its reasonable compliance efforts. Notably, the CE demonstrated it had a preexisting BA agreement with the BA, via its managing entity, Aurora Diagnostics, that sufficiently meets the requirements of the Privacy Rule. OCR obtained assurances that the CE implemented the correct