Carolina Oncology Specialists

On or about August 11, 2017, the covered entity (CE), Carolina Oncology Specialists, received correspondence from credit card companies addressed to three of its patients using the CE’s address. On September 6, 2017, one of the three patients reported a suspicious credit card transaction to the CE. The CE investigated and found that the perpetrator of the fraudulent transaction was a former employee who had had access to 1,551 patient files containing names, addresses, birthdates, social security numbers, and some medical information. The former employee had legitimate access to these files as an employee and it is unclear how many records she accessed in an unauthorized manner. In response to the breach, the CE notified the police and initiated an internal investigation. The police identified the same employee as the prime suspect for misusing patient information to open fraudulent credit card accounts. The CE found that there was no unauthorized access to its network or electronic medical records in the days immediately preceding the incident. To prevent such an incident in the future, the CE implemented additional technical safeguards to better track users on its network and limit the exposure of protected health information through more granular controls. The CE provided breach notification to HHS, affected individuals, and the media and also posted substitute notice on its website. The CE briefly delayed providing notification based on a law enforcement request. OCR obtained assurances that the CE implemented the corrective actions noted above.