District of Columbia, Department of Health Care Finance

The covered entity (CE), District of Columbia, Department of Health Care Finance, reported that a vulnerability in its website resulted in hidden protected health information (PHI) for two reports on its website could be accessed by individuals without authorization. According to the breach report, the breach affected approximately 399,086 individuals. The PHI involved dates of birth and other identifiers. The CE notified HHS, the media, and the affected individuals. In its mitigation efforts, the CE implemented additional technical controls to prevent a reoccurrence. OCR provided technical assistance to the CE regarding the HIPAA Rules and received evidence substantiating the CE’s notifications.