Marketing Clique

The business associate (BA) of Lone Star Circle of Care, the Covered Entity (CE) reported a breach of unsecured protected health information which affected 8,700 individuals. The breach was the result of a backup file inadvertently uploaded by the BA onto the CE’s website. The file contained the protected health information of patients who used the website to request appointments, prescription refills or other inquiries. The CE secured the data contained in the backup file, removed the pages that individuals use to make appointments and refill requests, and disabled the mobile application. The CE also terminated its business associate agreement with the BA, Marketing Clique. Further, during the investigation, OCR received confirmation that the BA was no longer doing business. The CE provided breach notification to HHS, the media, and the affected individuals. OCR examined CE’s policies concerning administrative, physical and technical safeguards implemented by the CE. As a result of the investigation, OCR provided technical assistance to the CE regarding the risk analysis and risk management plan and breach notification to individuals. The CE provided OCR with documentation of the corrective actions taken.