HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Sept. 2, 2017.
- Organization as reported
- Med-Cert, Inc., FL
- Entity type as reported
- Business Associate
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Network Server, Other
- Submission date
- Sept. 2, 2017
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14073, row:5212)
- Archived copy
- Held in the private archive (provenance)
On July 7, 2017, Med-Cert, Inc., a business associate (BA) for multiple health plans, learned that protected health information (PHI) was publically accessible through several online search engines including Bing and Google. The exposed PHI included the names, addresses, birthdates, employer information, and case management reports for 7,243 individuals, as well as some social security numbers. The BA provided breach notification to HHS and the affected individuals in a timely and compliant manner. No media or substitute notice was required. Following the breach, the BA discovered that the exposure was caused by a subcontractor, Alentus Hosting, which failed to reactivate a firewall after a software update. As a result, “web-crawlers” infiltrated the subcontractor’s computer network, stole electronic PHI, and posted it online. In response to the breach, the BA immediately contacted the subcontractor and had them close the vulnerability. The BA and the subcontractor did not have a BA agreement (BAA) in place. As a result of the breach, the subcontractor ceased responding to the BA’s request for information. The BA ended its business relationship with the subcontractor and acquired the services of another web hosting company, with which it has a HIPAA-compliant BA agreement. The BA contacted the search engines and was able confirm that the PHI was removed from public access. OCR provided technical assistance to the BA regarding the BA agreement requirements of HIP AA and obtained written assurances that the BA implemented the corrective actions listed above.