NEW YORKHHS OCRFirst filing
Filed Mar 9, 2018bd_8bdd9ce4e5256d61
The Arc of Erie County (NY) reported to HHS OCR on 2018-03-09 an Unauthorized Access/Disclosure affecting 3,751 individuals. Two spreadsheets containing PHI (demographic, clinical, and health insurance information) were inadvertently made publicly accessible via the internet due to a security protection failure on an internal hyperlink on the CE's website. The CE notified HHS, affected individuals, and the media. Remediation included disabling the exposed hyperlinks, engaging Avalon for HIPAA compliance review and managed detection/response, hiring a new IT director, and deploying patch management and intrusion detection software. OCR confirmed corrective actions were implemented.
Affected (this filing): 3,751
HHS notified