HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of Aug. 15, 2014.
- Organization as reported
- 24 ON Physicians PC, GA
- Entity type as reported
- Business Associate
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Network Server
- Submission date
- Aug. 15, 2014
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15016, row:6155)
- Archived copy
- Held in the private archive (provenance)
On June 10, 2014, 24 ON Physicians, the covered entity (CE), discovered that its business associate (BA), PST Services, hired an off-shore subcontractor GeBBS, which repurposed a computer server containing the protected health information (PHI) of 10,104 of the CE’s patients. The re-use of server made the PHI potentially available over the Internet from December 1, 2013, to April 17, 2014. The PHI included patients' names, invoice numbers, procedure codes, charge amounts, balances due, policy numbers, billing-related status comments, and dates of service. In response to this breach, the CE ensured that the server was taken off-line and the PHI was destroyed. The subcontractor submitted documentation stating that all of the breached PHI was destroyed. The CE informed OCR that it no longer works with the subcontractor. The CE provided breach notification to HHS, affected individuals and the media. It also provided affected individuals with one year of free credit monitoring. The CE initiated a plan to work with its BAs to strengthen security protocols to prevent this type of breach from occurring in the future. OCR obtained assurances that the CE and BA implemented the corrective actions listed above..