MedEvolve

HHS OCR settled with MedEvolve, Inc. for $350,000 regarding the unlawful disclosure of 230,572 individuals' PHI from an unsecured FTP server. The business associate failed to secure ePHI, conduct a thorough risk analysis, and execute a business associate agreement with a subcontractor.

MedEvolve reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2018-07-30. 409 Massachusetts residents were affected. The report records the breach type as electronic.

Supplemental notice to the New Hampshire Attorney General regarding MedEvolve's data breach. Initial notification on July 10, 2018, covered 84 residents; updated count after NCOA processing is 91 New Hampshire residents. Credit monitoring provided.

MedEvolve, a provider of electronic billing and record services to physicians and medical facilities, discovered on May 11, 2018, that an FTP file containing patient information was inadvertently accessible to the internet from March 29, 2018, to May 4, 2018. The file was subject to unauthorized access on March 29, 2018. Affected data included names, billing addresses, telephone numbers, primary health insurer account numbers, and Social Security numbers. MedEvolve secured the portal, engaged forensic investigators, and offered two years of complimentary credit monitoring.

MedEvolve reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2018-07-10. 368 Massachusetts residents were affected. The report records the breach type as electronic.

MedEvolve, Inc. reported to HHS on 2018-07-10 a Unauthorized Access/Disclosure affecting 230,572 individuals. Breached information located on Network Server. The breach resulted from the misconfiguration of an FTP server, exposing PHI including names, SSNs, and account numbers. MedEvolve paid a $350,000 settlement and agreed to a corrective action plan including risk analysis, policy updates, and enhanced training.

MedEvolve, a healthcare billing services provider, notified New Hampshire regulators of a data breach affecting 84 state residents. On May 11, 2018, MedEvolve discovered an FTP file containing patient PII (names, SSNs, addresses) was inadvertently accessible online from March 29 to May 4, 2018, and subject to unauthorized access starting March 29. MedEvolve engaged forensic investigators, secured the portal, and provided 2 years of credit monitoring to affected individuals.

MedEvolve notified Montana residents of a data breach where an FTP file containing patient PII (names, SSNs, addresses) was inadvertently accessible online from March 29 to May 4, 2018. Unauthorized access occurred on March 29, 2018. 15 individuals were affected. MedEvolve engaged forensic investigators and offered 2 years of credit monitoring.