HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of July 25, 2019.
- Organization as reported
- Arizona Dermatopathology, AZ
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Network Server
- Submission date
- July 25, 2019
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13296, row:4435)
- Archived copy
- Held in the private archive (provenance)
On May 15, 2019, a business associate (BA), American Medical Collection Agency, alerted the covered entity (CE), Arizona Dermatopathology, that the BA had discovered a potential data security incident. Upon initial review, the CE reported that the incident affected 5,903 individuals; however, after further analysis, the CE amended its report to indicate that 6,425 individuals were affected. The breach compromised the BA’s payment website and potentially the protected health information (PHI) of the CE’s patients with overdue accounts. The types of PHI involved included demographic and clinical information. In response to the breach, the CE ceased using the BA for collection efforts and informed affected individuals that payments for outstanding balances should no longer be made to AMCA. The CE provided breach notification to individuals, the media and HHS. The CE cooperated with OCR’s investigation and provided all requested documents and information to demonstrate its reasonable compliance efforts. Notably, the CE demonstrated it had a preexisting BA agreement, via Aurora Diagnostics, with the BA, that sufficiently meets the requirements of the Privacy Rule.