Medical imaging company to pay $3M to settle HIPAA breach impacting 300K patients

A Franklin, Tennessee-based medical imaging company will pay $3 million to the U.S. Department of Health and Human Services Office for Civil Rights (OCR) to settle potential Health Insurance Portability and Accountability Act (HIPAA) violations for a data breach that exposed the health information of 300,000 patients.

Touchstone Medical Imaging provides diagnostic medical imaging services in Nebraska, Texas, Colorado, Florida and Arkansas.

According to HHS, in May 2014, Touchstone was notified by the FBI and OCR that one of its FTP servers allowed uncontrolled access to its patients’ protected health information. HHS alleges that this uncontrolled access permitted search engines to index the patient data, such as birthdates and social security numbers, which remained visible on the internet even after the server was taken offline.