Middletown Medical P.C.

A misconfigured radiology interface application permitted unauthorized individuals to access 63,551 patients’ electronic protected health information (ePHI). The ePHI affected by this incident included patients’ names, dates of birth, client identification numbers, dates of service, and, for approximately 250 patients, radiology reports and images. The covered entity (CE) provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE secured the radiology application so that only authorized staff could access it, amended its policies and procedures to require that all systems and their security settings be tested in a test environment prior to live deployment, and trained relevant workforce members regarding this policy change. The CE also sanctioned the workforce member responsible for this incident. OCR obtained assurances that the CE implemented the corrective actions listed. Additionally, the CE is expected to perform a risk analysis and establish a risk management plan, and document the unauthorized disclosure of its patients’ ePHI for accounting of disclosure purposes. Also, the CE is expected to perform a technical and non-technical evaluation in response to environmental or operational changes, regularly review records of activity in all information systems, implement procedures for monitoring log-in attempts, and implement audit controls and valid encryption processes.