What changed afterward
- In response to the breach, the CE implemented additional safeguards to better protect its PHI.
Program action
Hold vendors to a signed BAA, a security assessment scaled to the data they hold, and a contractual breach-notice window shorter than the rule's 60 days.
HIPAA §164.308(b)(1), 164.314(a), 164.410
CISSP 1CISM 2CISA 2
Full OCR narrative
The covered entity (CE), Imagine the Possibilities, reported that it was notified by its business associate (BA), PDCM Insurance, that the BA experienced a breach involving access to its network by an unauthorized threat actor, affecting the protected health information (PHI)of 1,693 individuals. The PHI involved clinical and demographic information. The CE notified HHS, the media, and the affected individuals. In response to the breach, the CE implemented additional safeguards to better protect its PHI.