Aventura Hospital and Medical Center

On or around May 28, 2014, the covered entity (CE), Aventura Hospital and Medical Center, discovered that an employee of Valesco Ventures, a contractor that provides staffing and ancillary services, had inappropriately accessed the protected health information (PHI) of about 82,601 patients that included demographic information. The CE provided breach notification to HHS, affected individuals, and the media and also posted substitute notice on its website. The CE offered credit monitoring and identity theft protection to all affected individuals. Following the breach, the CE re-trained its workforce on its HIPAA Privacy and Security policies and procedures. Additionally, the CE updated its audit functions to capture similar unauthorized activities in the future. The CE reviewed all access of the system’s users and made changes as needed; it also increased the approval level before anyone can have access to the system. The CE revised its business associate contracts with its business partners. The CE also improved technical safeguards by performing a new risk analysis and creating an updated risk management plan. OCR obtained assurances that the CE implemented the corrective actions listed above.