CAPITOL CARDIOLOGY ASSOCIATES

The covered entity (CE), Capital Cardiology Associates, reported that during a two month period the protected health information (PHI) of individuals may have been exposed when its business associate (BA) inadvertently removed the authentication methods for secure access to its fax cloud service portal. The breach involved the protected health information (PHI) of 1,980 individuals. The types of PHI involved included medical records, names, addresses, dates of birth, phone numbers, social security numbers, and account numbers. The CE obtained proof that its BA had rectified the cause of the breach. The CE notified the affected individuals, published notice in the media, and posted notice on its website. Additionally, the CE adopted HIPAA Privacy and Security Rule policies and procedures and trained its staff. As a result of its investigation, OCR obtained assurances that the CE implemented the corrective actions noted above.