Consultants in Neurological Surgery, LLP

The covered entity (CE), Consultants in Neurological Surgery, discovered on September 9, 2016, that an employee stole patients’ credit card information for her own personal use while processing the patients’ co-payments. The employee had access to the demographic, clinical, and financial information of 800 individuals. The CE provided breach notification to HHS, affected individuals, and the media. OCR provided technical assistance to the CE regarding the Breach Notification Rule and the Security Rule. In response to the beach, CE altered its policies for handling credit card payments and limited the types of information maintained in its practice management software. In addition, the CE retrained its workforce and revised its policies and procedures. OCR obtained assurances that the CE implemented the corrective actions listed above. The CE also sanctioned the involved employee (which in this case included termination of employment).