You received a call from a patient today whose identity has been stolen. He blames your facility for the breach. You researched his complaint and do not find any indication that there has been a breach of the patients data. You decide to call your business associates to see what they can find. When you call Coding Consulting, they admit that they had a security breach several months ago due to a hacker, and patient information was accessed. This patient information included Social Security numbers. Coding Consulting had not notified you of their breach as per the business associate agreement.

1. Identify the privacy and security violations that have occurred.
2. Identify what Coding Consulting should have done.
3. Determine what your facility should do now.