Consultants Choice, P.A.

On July 6, 2017, Consultant’s Choice, P.A., the covered entity (CE), learned that an unauthorized individual had accessed its computer and the electronic protected health information (ePHI) of 1,471 individuals. The exposed ePHI included demographic, clinical, and health insurance information, including the social security numbers of 40 individuals. The CE hired a forensic firm and learned that the unauthorized user likely used written login credentials stored near the computer to gain access. In response to the breach, the CE obtained new computer equipment, created new security management policies and procedures, removed all electronic PHI from its computer, and implemented additional technical safeguards. The CE provided breach notification to HHS, affected individuals, the media, and posted substitute notice in a local newspaper. OCR provided technical assistance to the CE and obtained assurances that the CE implemented the corrective actions noted above.