Health Fitness Corporation

HHS OCR settled a HIPAA Security Rule investigation with Health Fitness Corporation, a business associate providing wellness plans. Health Fitness failed to conduct an accurate risk analysis until 2024, resulting in ePHI exposure via server misconfiguration. The settlement amount is $227,816. Health Fitness agreed to a Corrective Action Plan including annual risk analyses, risk management plans, and updated policies.

Health Fitness Corporation reported to HHS OCR on 2018-10-28 a software misconfiguration affecting 614 individuals. ePHI became discoverable on the internet via web crawlers starting in August 2015. The breach was discovered on June 27, 2018. Health Fitness, a business associate, settled with OCR for $227,816 and agreed to a corrective action plan.

Health Fitness Corporation reported to HHS on 2018-10-15 a Unauthorized Access/Disclosure affecting 550 individuals. Breached information located on Other. The incident involved a software misconfiguration on a server housing ePHI, making it discoverable on the internet starting in August 2015. Health Fitness, a Business Associate, filed reports on behalf of multiple covered entities.

Health Fitness Inc reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2018-10-05. 175 Massachusetts residents were affected. The report records the breach type as electronic.

Health Fitness Corporation, a Business Associate in Illinois, reported the theft of a laptop containing the personal information of 4,837 individuals. The breach was submitted to HHS on November 14, 2013.

Health Fitness Corporation (a Business Associate, IL) reported to HHS on 2013-11-14 a Theft affecting 3,804 individuals. An unencrypted company laptop was stolen from a BA employee's car. The laptop contained PHI including employee and/or spouse names, birthdates, health plan elections, and Social Security numbers. The CE notified HHS; the BA notified affected individuals and media. Corrective actions included mandatory laptop encryption policies, employee training, and a BA certification process for encrypted mobile devices. OCR obtained assurances that all corrective actions were taken. Breached information located on Laptop.