Center for Comprehensive Services, Inc.

A business associate (BA), Bullpen Financial, Inc., mailed an unencrypted portable computer drive (a “USB” drive) to the covered entity’s (CE’s) parent company as their business relationship was ending, but it was lost in the mail and not recovered. The lost USB drive contained the electronic protected health information (ePHI) of the CE’s consumers, including the demographic information of 1,176 individuals, and for some, clinical information. The CE’s parent company provided breach notification to HHS; the CE provided breach notification to affected individuals. Following the breach, the CE engaged an outside forensics firm to investigate and also entered into a BA agreement with its parent company, which is not a HIPAA covered entity. OCR provided technical assistance to the CE regarding the timeliness requirements of the breach notification rule, the definition of PHI, and the BA agreement requirements under the Rules.