Med-Cert, Inc.

On July 7, 2017, Med-Cert, Inc., a business associate (BA) for multiple health plans, learned that protected health information (PHI) was publically accessible through several online search engines including Bing and Google. The exposed PHI included the names, addresses, birthdates, employer information, and case management reports for 7,243 individuals, as well as some social security numbers. The BA provided breach notification to HHS and the affected individuals in a timely and compliant manner. No media or substitute notice was required. Following the breach, the BA discovered that the exposure was caused by a subcontractor, Alentus Hosting, which failed to reactivate a firewall after a software update. As a result, “web-crawlers” infiltrated the subcontractor’s computer network, stole electronic PHI, and posted it online. In response to the breach, the BA immediately contacted the subcontractor and had them close the vulnerability. The BA and the subcontractor did not have a BA agreement (BAA) in place. As a result of the breach, the subcontractor ceased responding to the BA’s request for information. The BA ended its business relationship with the subcontractor and acquired the services of another web hosting company, with which it has a HIPAA-compliant BA agreement. The BA contacted the search engines and was able confirm that the PHI was removed from public access. OCR provided technical assistance to the BA regarding the BA agreement requirements of HIP AA and obtained written assurances that the BA implemented the corrective actions listed above.