HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of July 10, 2018.
- Organization as reported
- MedEvolve, AR
- Entity type as reported
- Business Associate
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Network Server
- Submission date
- July 10, 2018
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13758, row:4897)
- Archived copy
- Held in the private archive (provenance)
Today, the U.S. Department of Health and Human Services’ Office for Civil Rights (OCR) announced a settlement with MedEvolve, Inc. (“MedEvolve”), a business associate that provides practice management, revenue cycle management, and practice analytics software services to health care entities. The settlement was signed to resolve a data breach resulting from the misconfiguration of a File Transfer Protocol (“FTP”) server that caused the protected health information of 230,572 individuals to be unsecure and accessible on the internet. The potential violations of the Health Insurance Portability and Accountability Act (HIPAA) include the lack of an analysis to determine risks and vulnerabilities to electronic protected health information across the organization, and the failure to enter into a Business Associate Agreement with a subcontractor. As a result MedEvolve paid $350,000 to OCR and agreed to implement a corrective action plan, which identifies steps MedEvolve will take to resolve these potential violations and protect the security of electronic patient health information. “Ensuring that security measures are in place to protect electronic protected health information where it is stored is an integral part of cybersecurity and the protection of patient privacy,” said OCR Director Melanie Fontes Rainer. “HIPAA-regulated entities must ensure that they are not leaving patient health information unsecured on network servers available to the public via the internet.” In July 2018, OCR initiated an investigation of MedEvolve following the receipt of a breach notification report stating that a FTP server containing electronic protected health information was openly accessible to the internet. The information included patient names, billing addresses, telephone numbers, primary health insurer and doctor's office account numbers, and in some cases Social Security numbers. In addition to the monetary settlement, MedEvolve will undertake a comprehensive corrective action…