OCR has hit another covered entity for failure to protect the PHI of its patients. Phoenix Cardiac Surgery, P.C., of Phoenix and Prescott, Arizona, has agreed to pay HHS $100,000 and take corrective action to come into compliance with HIPAA. The problems came to light when a complaint was filed because the practice was posting clinical and surgical appointments on a Web-based, publicly available calendar. During its investigation, OCR also found that the practice never appointed a security officer, had very few policies and procedures, had no record of staff training, and had no business associate agreements with the service posting the appointments. Click here for the press release and access to the settlement documents.