What changed afterward
- In its mitigation efforts, the CE implemented additional technical controls to prevent a reoccurrence.
Program action
Enforce least privilege, MFA for remote and privileged access, and proactive EHR access audits.
HIPAA §164.312(a)(1), 164.312(d), 164.308(a)(4)
CISSP 5CISA 5
Full OCR narrative
The covered entity (CE), District of Columbia, Department of Health Care Finance, reported that a vulnerability in its website resulted in hidden protected health information (PHI) for two reports on its website could be accessed by individuals without authorization. According to the breach report, the breach affected approximately 399,086 individuals. The PHI involved dates of birth and other identifiers. The CE notified HHS, the media, and the affected individuals. In its mitigation efforts, the CE implemented additional technical controls to prevent a reoccurrence. OCR provided technical assistance to the CE regarding the HIPAA Rules and received evidence substantiating the CE’s notifications.