Sheet Metal Local 36 Welfare Fund

The covered entity (CE), Sheet Metal Local 36 Welfare Fund, reported that an employee of its business associate (BA), People Resources Corporation, inadvertently uploaded Excel spreadsheets containing the CE’s Member Assistance Program (MAP) eligibility data onto an unsecure website maintained by the BA. An unknown individual or entity believed to be in China uploaded the data to two additional websites. In addition, two other websites contained links to the BA’s unsecure website. The spreadsheets contained the names, addresses, dates of birth, and social security numbers of 4,560 members (but not dependents). The BA was purchased by E4 Health, Inc. in September 2013. The CE provided breach notification to HHS, affected individuals, and the media. The BA immediately removed the protected health information (PHI) from the unsecure website, confirmed that the PHI was no longer available on its websites or through internet search engines, and confirmed that only one spreadsheet was accessed by unauthorized parties and the other spreadsheets had not been viewed or compromised. The BA adopted additional protections to prevent future unauthorized disclosures (including management level review of any documents posted to its websites). Additionally, the CE met with each of its vendors to review the vendors’ security procedures and protocols and instituted a review program, as well as reviewed its own internal procedures. OCR obtained assurances that the CE and BA implemented the corrective actions listed.