Just six months after discovering a data breach that violated HIPAA and New York law, a nonprofit organization that serves individuals with disabilities has already agreed to a $200,000 settlement, State Attorney General (SAG) Barbara Underwood announced on Aug. 29.
But the state settlement doesn’t mean The Arc of Erie County is out of the woods with the HHS Office for Civil Rights (OCR), which has shown it is willing to collect penalties even when states have already acted, and especially when sensitive information is at issue as it is here.
The Arc acknowledged that, for nearly three years, information—including IQ scores—was accessible online for close to 4,000 of the “most vulnerable New Yorkers,” in the words of Underwood.
In a March 9 breach notice, The Arc said a “coding error” resulted in information for 3,700 clients “contained on two spreadsheets stored on its database” being posted on the internet from July 2015 to Feb. 15 of this year. Exposed data consisted of “full names, social security numbers, gender, race, primary diagnosis codes, IQs, insurance information, addresses, phone numbers, dates of birth, and ages.” The exposure did not stem from “a malicious attack seeking protected information.”
Details of the breach and settlement are found in the SAG’s Assurance of Discontinuance with The Arc, a copy of which Underwood’s office provided to RPP. The assurance states that The Arc admitted to the facts spelled out in the document.
