Florida Hospital Medical Group

Florida Hospital Medical Group, the covered entity (CE), reported that providers dictated health information to its transcription service company, Data Tray, which transmitted the health information back to the providers using an unencrypted email account. The protected health information (PHI) involved included the names, diagnoses, conditions, and medications prescribed of 1,906 individuals. The CE notified HHS, affected individuals, the media, offered complimentary credit monitoring services, and set up a toll free number for questions and concerns. During OCR’s investigation, we found that the CE did not have a business associate agreement (BAA) in place with Data Tray. In its mitigation efforts, the CE ended its relationship with Data Tray and entered into a BAA with a new transcription vendor. The CE also implemented additional administrative safeguards to better protect its PHI and retrained its staff. OCR obtained assurances that the CE implemented the corrective actions noted.