Orlando Orthopaedic Center Suffers 19,000-Record Breach Due to Business Associate Error
An error made by a transcription service provider during a software upgrade on a server has resulted in the exposure of more than 19,000 patients’ protected health information (PHI).
Patients affected by the breach had received medical services at Orlando Orthopaedic Center clinics in Orlando, Florida prior to January 2018.
The software upgrade took place in December 2017 and throughout the month, PHI stored on the server became accessible over the Internet without any need for authentication. Orlando Orthopaedic Center only became aware of the exposure of patients’ PHI in February 2018.
The discovery of the breach prompted a full investigation, which revealed names, dates of birth, insurance information, employer details, and treatment types were accessible. A limited number of patients also had their Social Security numbers exposed.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
It is unclear whether any PHI was accessed by unauthorized individuals during the time that the protections were removed. Orlando Orthopaedic Center said it has not received any reports from patients that indicate PHI has been misused and no evidence of unauthorized access or data theft has been uncovered; however, data theft and unauthorized access could not be ruled out.
Credit monitoring and identity theft protection services have been offered to all patients whose Social Security number was exposed. All patients have been advised to monitor their accounts and Explanation of Benefits Statements for any sign of fraudulent use of their PHI and have now been notified of the breach by mail.
Orlando Orthopaedic Center stated in a new release that its vendor has corrected the issue and all PHI has been secured. Ongoing cybersecurity awareness training is provided to all Orlando Orthopaedic Center staff and its own security solutions are regularly updated to ensure all PHI stored on its servers and endpoints remains secure.
The breach report submitted to the Department of Health and Human Services’ Office for Civil Rights on July 20, 2018 indicates 19,101 patients had their PHI exposed.
It is unclear why it took 5 months from the discovery of the breach to issuing notifications and informing OCR when HIPAA requires notifications to be issued within 60 days of the discovery of a breach.
