Advanced ENT Head & Neck Surgery

A workforce member of the covered entity (CE), Advanced ENT Head and Neck Surgery, surreptitiously took pictures of patients, recorded conversations with patients, and made paper copies of patients’ legal identification, payment information, and paper medical records. The workforce member also stole several mobile devices containing electronic protected health information (ePHI) and in some cases, posted the breached information to a social media account. The breach affected approximately 15,000 individuals, and the types of PHI and ePHI involved included clinical, demographic and financial information. The CE provided breach notification to HHS and also notified other enforcement agencies with jurisdiction over the breach incident. In response to the breach, which the CE discovered around May 1, 2017, the CE adopted encryption technologies, improved password requirements, updated its Security Rule Risk Management Plan, implemented new technical safeguards, improved physical security, and revised its HIPAA policies and procedures. The CE also sanctioned the involved workforce member, which in this case included terminated of employment. OCR has closed its investigation because this case has been accepted for investigation by the Department of Justice.