National Imaging Associates, Inc.

National Imaging Associates, Inc. (MD) reported to HHS OCR on 2022-05-02 an Unauthorized Access/Disclosure affecting 744 individuals. A business associate employee impermissibly shared PHI — including names, addresses, dates of birth, diagnoses, lab results, medications, and treatment information — with an unauthorized individual via laptop. The BA sanctioned the workforce member, implemented additional safeguards, and retrained all staff. The CE notified HHS, affected individuals, and the media.

National Imaging Associates (NIA), a subsidiary of Magellan Health, disclosed that an employee (Physician Clinical Reviewer) shared screen access via Zoom with an unauthorized non-employee guest while reviewing health plan member cases. This occurred between November 1, 2021, and March 8, 2022. The incident was discovered on March 7, 2022. Affected data includes protected health information (diagnoses, treatments, medical history) and demographic data (name, address, DOB). The employee was terminated, and 12 months of identity monitoring were offered.

National Imaging Associates, Inc. reported to HHS on 2022-04-22 a Unauthorized Access/Disclosure affecting 616 individuals. Breached information located on Laptop. An employee of the business associate impermissibly shared PHI (names, addresses, DOB, diagnoses, lab results, medications) with an unauthorized individual.

National Imaging Associates reported to HHS on 2020-06-12 a Hacking/IT Incident affecting 22560 individuals. Breached information located on Email, Network Server. The incident involved a ransomware attack by a business associate. This case is closed and consolidated into an existing investigation.

National Imaging Associates, Inc. reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2019-12-19. 14 Massachusetts residents were affected. The report records the breach type as electronic.

National Imaging Associates reported to HHS on 2019-09-17 a Hacking/IT Incident affecting 589 individuals. Breached information located on Email. A former employee was victim of an email phishing scheme affecting ePHI including names, DOB, SSN, and diagnoses. CE notified HHS, individuals, and media, and strengthened technical safeguards.