HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of May 31, 2017.
- Organization as reported
- Advanced ENT Head & Neck Surgery, CA
- Entity type as reported
- Healthcare Provider
- Category as reported
Theft
- Location of information as reported
- Desktop Computer, Electronic Medical Record, Email, Laptop, Other, Other Portable Electronic Device, Paper/Films
- Submission date
- May 31, 2017
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14175, row:5314)
- Archived copy
- Held in the private archive (provenance)
A workforce member of the covered entity (CE), Advanced ENT Head and Neck Surgery, surreptitiously took pictures of patients, recorded conversations with patients, and made paper copies of patients’ legal identification, payment information, and paper medical records. The workforce member also stole several mobile devices containing electronic protected health information (ePHI) and in some cases, posted the breached information to a social media account. The breach affected approximately 15,000 individuals, and the types of PHI and ePHI involved included clinical, demographic and financial information. The CE provided breach notification to HHS and also notified other enforcement agencies with jurisdiction over the breach incident. In response to the breach, which the CE discovered around May 1, 2017, the CE adopted encryption technologies, improved password requirements, updated its Security Rule Risk Management Plan, implemented new technical safeguards, improved physical security, and revised its HIPAA policies and procedures. The CE also sanctioned the involved workforce member, which in this case included terminated of employment. OCR has closed its investigation because this case has been accepted for investigation by the Department of Justice.