University Gastroenterology, Inc.

An unauthorized person gained access to the covered entity’s (CE) electronic file storage system. The breach affected 15,478 individuals’ protected health information (PHI) and included patients’ names, addresses, dates of birth, social security numbers, and medical billing information. Following the breach, the CE completely dismantled the accessed system. OCR reviewed the CE’s policies and procedures for safeguarding PHI, which conform to the HIPAA Privacy and Security Rules. The CE provided OCR with assurances that it provided breach notification to affected individuals and the media.