Associated Urologists of North Carolina

On September 11, 2013, a patient of the covered entity (CE), Associated Urologists of North Carolina (AUNC), notified the CE that when he did an internet search for his name he was able to see a list identifying him as an AUNC patient. The CE investigated and discovered that protected health information (PHI) was accessible on the internet from September 17, 2012, to September 11, 2013, and that the breach was due to the way medical notes had been transcribed. An employee uploaded audio files and lists of patients’ names through a file transfer protocol (FTP) site to assist with transcription. The files included the names, dates of birth, phone numbers, referring physicians, chart numbers, and reasons for visits for 7,297 patients. In response to the incident, the CE immediately discontinued use of the FTP site, removed all of its files from the unsecure website, and contacted Google to have all cached copies of the files removed. The CE also provided breach notification to HHS, affected individuals, and the media and offered free credit monitoring and a toll free number to answer questions. The CE also reviewed its policies and retrained all staff on it data privacy and information security policies. Additionally, the CE partnered with a security contractor to develop and implement new policies and procedures to safeguard electronic PHI. OCR obtained assurances that the CE implemented the corrective actions listed above.