HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Aug. 27, 2020.
- Organization as reported
- Assured Imaging, AZ
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Network Server
- Submission date
- Aug. 27, 2020
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 12725, row:3864)
- Archived copy
- Held in the private archive (provenance)
Today, the U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR) announced a settlement with Assured Imaging (“Assured”) on behalf of Assured Imaging Affiliated Covered Entities, a medical imaging and screening service provider, concerning a potential violation of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Security Rule. Assured is a covered entity that provides services in Arizona, California, Georgia, , New Mexico, Nevada, New York, New Jersey, Pennsylvania, Texas, Oregon, and Washington . The settlement resolves an investigation that OCR initiated after receiving a breach report that Assured filed on August 27, 2020. Assured reported that on May 19, 2020, Assured discovered that a server on its network was infected with ransomware, impacting the PHI of over 244,000 patients. Affected PHI included patient names, addresses, dates of birth, diagnosis and conditions, lab results, medications, and treatment information. OCR’s investigation determined that Assured had impermissibly disclosed PHI, failed to conduct an accurate and thorough risk analysis to determine the potential risks and vulnerabilities to the confidentiality, integrity, and availability of its ePHI, and failed to timely notify affected individuals of the breach. Under the terms of the resolution agreement, Assured agreed to implement a corrective action plan that will be monitored by OCR for two years and paid $375,000 to OCR. Under the corrective action plan, Assured has committed to take steps to ensure compliance with the HIPAA Security Rule and protect the security of ePHI, including: • Conduct an accurate and thorough risk analysis to determine the potential risks and vulnerabilities to the confidentiality, integrity, and availability of its ePHI; • Develop and implement a risk management plan to address and mitigate security risks and vulnerabilities identified in its risk analysis to a reasonable and appropriate level; • Develop,…