Northeast Radiology

HHS OCR settled a HIPAA Security Rule investigation with Northeast Radiology, P.C. (NERAD) for $350,000. The settlement resolved allegations that NERAD failed to conduct an accurate and thorough risk analysis of vulnerabilities to ePHI stored in its PACS server, where unauthorized individuals accessed radiology images. NERAD agreed to a Corrective Action Plan including risk analysis, risk management, policy updates, and workforce training.

Northeast Radiology (NERAD) notified Montana residents that its IT provider, Alliance HealthCare Services, experienced unauthorized access to its PACS system between April 14, 2019, and January 7, 2020. The breach potentially exposed PHI, SSNs, and demographic data. NERAD engaged forensic investigators and offered one year of Experian IdentityWorks.

Northeast Radiology, P.C. (NERAD) reported to HHS OCR on 2020-03-11 a Hacking/IT Incident affecting 298,532 individuals. Between April 2019 and January 2020, unauthorized individuals accessed radiology images stored on NERAD's PACS (Picture Archiving and Communication System) network server. OCR's investigation found NERAD failed to conduct a required risk analysis. NERAD paid a $350,000 settlement and entered a two-year corrective action plan as the 6th enforcement action under OCR's Risk Analysis Initiative.

Northeast Radiology reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2020-03-11. 487 Massachusetts residents were affected. The report records the breach type as electronic.