E-dreamz, Inc.

The credit card information of 9,988 patients of the covered entity (CE), Presbyterian Anesthesia Associates, P.A. (now known as Providence Anesthesia Associates, P.A.), was compromised when an unauthorized person gained access to the servers of E-dreamz, the CE’s website hosting business associate (BA). The protected health information (PHI) involved in the breach included patients’ names, addresses, phone numbers, email addresses, and credit card information. The CE provided breach notification to HHS, the media, and affected individuals, and offered them a year of free credit monitoring and identity theft protection. The CE also notified the FBI, North Carolina’s Attorney General, and all major credit card companies. In response to the breach, the CE hired an outside forensic computer specialist to investigate. Additionally, the CE terminated its service agreement with the BA and entered into a satisfactory BA agreement with a new website hosting vendor. The BA agreement prohibits storage of any PHI on the vendor’s servers. The CE also reviewed and updated its HIPAA policies and procedures. OCR obtained assurances that the CE implemented the corrective actions listed.