City of Philadelphia Fire Department Emergency Medical Services Unit

In 2012 a rogue employee of the covered entity’s (CE) business associate (BA), Intermedix (dba Advanced Data Processing, Inc.), improperly accessed and disclosed the account information of individuals served by 27 ambulance agencies in 17 states. The CE was initially notified that none of its data was involved; however, on February 3, 2015, the CE was notified by law enforcement in Opa-Locka, Florida that a sheet of paper containing account information regarding the CE’s services was found on a person arrested on that date. Following the 2015 notification, the BA’s investigation confirmed 34 known disclosures, 746 likely disclosures and 80,684 individuals’ protected health information (PHI) that was at risk of disclosure. The types of PHI involved in the breach included demographic information, social security numbers, and health insurance information. The CE provided breach notification to HHS, affected individuals, and the media, and posted substitute notice on its website. The BA offered 36 months of free credit monitoring and fraud resolution services. Following the breach, the BA created an information security team within its Compliance Department, integrated new security measures into its billing system, and developed a new user interface placing further restrictions on employees based on specific job roles. The CE revised the BA agreement. OCR also obtained assurances that the BA implemented the corrective measured listed above.