HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of July 25, 2016.
- Organization as reported
- American Family Care, Inc., AL
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Electronic Medical Record, Other
- Submission date
- July 25, 2016
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14469, row:5608)
- Archived copy
- Held in the private archive (provenance)
American Family Care, Inc., the covered entity (CE), discovered that its software impermissibly disclosed the electronic protected health information (ePHI) of patients who received services at the clinic. The breach occurred from August 8, 2015 until June 14, 2016 and affected 7,200 individuals. The PHI involved in this breach included names, dates of birth, addresses, internal patient identification numbers, gender, and body parts being x-rayed. The CE provided breach notification to HHS, affected individuals, and the media and posted substitute notification on its website. In response to the breach, the CE worked with its software vendor to modify the software to prevent users from including a copy of the entire database with any electronic patient files in the future. The CE also revised its policies, trained its staff on the new policies, and sanctioned an employee for failure to timely update the software licenses. OCR obtained assurances that the CE implemented the corrective actions listed above.