Silver Cross Hospital

Beginning on or around November 30, 2016, Silver Cross Hospital’s business associate (BA), Demi & Cooper Advertising, updated its software. The software upgrade reconfigured security settings such that data in completed web forms was potentially made available on the internet without password protection. This breach affected 8,862 individuals. The types of protected health information involved in the breach included demographic, financial and clinical information. Following the breach, the covered entity (CE) hired a third party forensic investigator and determined that no one had impermissibly accessed the information in the web forms, but the “Bing” search engine cached six pages and indexed four pages. The CE requested that Bing remove the information from its data base and the forensic investigation company confirmed the removal. The CE also implemented additional security safeguards for its web forms and conducted a HIPAA Security risk analysis. CE provided breach notification to HHS, affected individuals, and the media, as well as posting substitute notice, as required by the Breach Notification Rule. OCR obtained assurances that the CE implemented the corrective actions noted here.