Virtual Radiologic Professionals, LLC

Virtual Radiologic Professionals (VRad), the covered entity (CE), reported that its vendor, MedData, a business associate (BA), experienced a programming error which caused the protected health information (PHI) of 846 individuals to be sent to the wrong recipients. When investigating this breach, MedData discovered that an additional programming error caused the PHI of 2,590 individuals to be entered into the incorrect billing records and also sent to the wrong recipients. VRad notified HHS, affected individuals, and the media. Substitute notice was also posted on its website. MedData revised its software to correct the errors. OCR provided technical assistance regarding vRad’s compliance obligations under the HIPAA Security Rule. As a result of OCR’s investigation, vRad developed and revised relevant procedures and developed an inventory of its business associates and its associated agreements. OCR obtained assurances that the aforementioned corrective actions were implemented.