Integrated Rehab Consultants

On December 2, 2016, a health care researcher notified the covered entity (CE), Integrated Rehab Consultants, that its data was present on an online public repository, Github. Upon investigation, the CE determined that its vendor, TrueRCM, provided the data to another third-party vendor, Magnum, who then inadvertently uploaded the data to Github. The CE believed that the access to the data was limited to the health care researcher who reported the incident to IRC. However, in the fall of 2017, the CE discovered that the data had been accessed by at least one additional party. The CE continued its investigation of the incident and ultimately determined that it could not conclusively rule out unauthorized access to the data by other third parties. The breach affected 4,292 individuals. The protected health information involved in the breach included demographic and clinical information. The CE provided breach notification to HHS, affected individuals, and the media and posted substitute notice on its website. The CE responded to the breach by working with Magnum to remove the data from the Github repository and confirming that TrueRCM terminated its service relationship with Magnum. The CE also updated its HIPAA policies and procedures pertaining to the Breach Notification Rule, safeguards, and business associates and trained its workforce on the revised policies and procedures. The CE demonstrated that at the time of the breach current BA agreements were in place between IRC and TrueRCM and between TrueRCM and Magnum. OCR obtained documented assurances that the CE implemented the corrective actions listed above.