You received a call from a patient today whose identity has been stolen. He blames your healthcare organization for the breach. You researched his complaint and do not find any indication that there has been a breach of the patient's data. You decide to call your business associates to see what they can find. When you call Coding Consulting, they admit that they had a security breach several months ago due to a hacker, and patient information was accessed. This patient information included Social Security numbers. Coding Consulting had not notified you of their breach as per the business associate agreement.

Identify the privacy and security violations that have occurred.

Identify what Coding Consulting should have done.