An error made by a transcription service provider during a software upgrade on Orlando Orthopaedic Center (OOC)’s server in December 2017 has resulted in the exposure of more than 19,000 patients’ protected health information (PHI). PHI stored on OOC’s server from December 2017 until February 2018 – when the breach was finally discovered – was freely exposed over the internet without any authentication. Upon full investigation, patients’ names, social security numbers, dates of birth, insurance information, employer details, and treatment types were deemed accessible.

Although it remains unknown whether any PHI was accessed by unauthorized individuals during the two month exposure period, OOC has said the vendor has corrected the issue. OOC has offered credit monitoring and identity theft protection to all patients whose social security numbers were exposed as well as provided ongoing cybersecurity awareness training to its staff.

There was a delay between the discovery of the breach and the breach notification to the Department of Health and Human Services’ Office for Civil Rights (HHS-OCR), the media, and the individual patients, which may carry risks of additional penalty for noncompliance with the Health Insurance Portability and Accountability Act (HIPAA). HIPAA requires notice within 60 days of the discovery of a breach to HHS-OCR, the media, and the affected individuals when PHI of more than 500 individuals is exposed. Although the breach incident appears on HHS-OCR’s Breach Portal, it remains under investigation with the agency.

This incident is another important reminder of the importance of engaging vendors that incorporate strong electronic PHI management in business associate agreements. It is also important to consider including specific breach notification requirements in contracts to ensure timely notification in the event of a breach.