Central Ohio Urology Group, Inc.

Electronic protected health information (ePHI) contained on the covered entity’s (CE) computer server was compromised by an unauthorized third-party from July 18 to August 2, 2016. The PHI involved in the compromised server included full names, Social Security numbers, dates of birth, home addresses, drivers’ licenses, claims information, credit/bank account numbers, and treatment notes pertaining to 300,000 individuals. The CE provided breach notification to HHS, affected individuals, and the media, and also posted substitute notice on its website. Following the breach, the CE retained a forensic firm, conducted a new risk assessment, installed an enhanced firewall system, updated its anti-virus software, and implemented safeguards related to access. OCR obtained written assurances that the CE implemented the corrective actions listed above.