NRAD Medical Associates, P.C.

NRAD Medical Associates, the covered entity (CE), reported that an employee impermissibly downloaded 96,998 patients’ protected health information (PHI) onto a desktop computer and a personal external hard drive. The PHI included patients’ names, addresses, dates of birth, dates of service, social security numbers, procedure and diagnosis codes. The CE provided breach notification to HHS, affected individuals, and the media. During OCR’s investigation, the CE sanctioned a physician and filed for Chapter 11 bankruptcy. The CE transferred all of its assets to another imaging group and hospital. Ultimately, the CE ceased its operations and thus was no longer covered by the HIPAA Rules.