HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of July 20, 2016.
- Organization as reported
- Neurology Physicians LLC, MD
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Other
- Submission date
- July 20, 2016
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14476, row:5615)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE), Neurology Physicians, reported that in February, 2010, it entered into a medical transcription services agreement with a business associate (BA) located in Bangalore, India that provides dictation and transcription services for the physicians. On May 23, 2016, a patient discovered the office notes from her visit were viewable online. The CE learned that the transcribed files were uploaded onto a public Hypertext Markup Language (HTML) folder that was publicly searchable. The breach affected 4,831 individuals and included clinical information. The CE does not have any evidence that transcription files were actually viewed or acquired by any third parties; however, it acted in an abundance of caution in response to the breach due to the potential that the transcription files became publicly searchable at some point between 2010 and 2016, and the inability to determine if any third parties may have viewed the transcription files. To the best of the CE's knowledge, only the two patients who discovered the breach and the individuals involved in the investigation and remediation of the breach on behalf of the CE actually viewed any PHI and did not retain it. OCR reviewed the CE's risk analysis and BA agreements. The CE terminated its relationship with the BA. The CE stated that it ensured a detailed risk assessment was conducted to identify any vulnerabilities and a gap analysis work plan was developed and worked through to address such vulnerabilities. Additionally, the CE installed a new server with fully updated security settings and updated its Notice of Privacy Practices. OCR obtained assurances that CE implemented the corrective action listed above.