AccuDoc Solutions, Inc.

A business associate (BA), AccuDoc Solutions, Inc., discovered on September 29, 2018, that an unauthorized user had gained access to a web server which contained the electronic protected health information (ePHI) for seven of its covered entity (CE) clients, affecting 2,652,537 individuals. While no data was exfiltrated, the ePHI that was potentially exposed included demographic information, account balances, and insurance policy information. In response to the breach, the BA terminated the unauthorized user’s access and improved technical safeguards. The CEs provided breach notification to affected individuals and the media. The BA provided breach notification to HHS on behalf of six out of seven CE clients. One CE notified HHS on its own. OCR obtained assurances that the BA implemented the corrective actions listed.