Dr. Veronica Joann Barber

Another provider, Veronica Joann Barber, O.D., (VB) copied the covered entity’s (CE) entire data base and used the electronic protected health information (ePHI) to solicit patients for her own practice. VB worked at the CE’s office under a space-sharing agreement until the CE terminated the agreement. The CE requested that VB cease and desist using the PHI, but she did not agree. The theft occurred on December 15, 2013, and affected 4,000 individuals. The ePHI involved in the breach included individuals’ names, social security numbers, addresses, driver’s licenses, dates of births, other identifiers, credit card and bank account numbers, claims information, other financial information, diagnoses and medical conditions, medications, and other treatment information. The CE provided breach notification to HHS and affected individuals. Following the breach the CE installed computer firewalls. Based on OCR’s provision of technical assistance, the CE notified the media and completed a risk assessment. It also improved safeguards by denying access by unlicensed persons to its computer systems and updating its policies and procedures regarding computer user names and passwords. The CE improved physical safeguards by moving the computer with the ePHI behind a 5-foot tall counter.