HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of April 11, 2018.
- Organization as reported
- Atchison Hospital Association, KS
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Network Server
- Submission date
- April 11, 2018
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13860, row:4999)
- Archived copy
- Held in the private archive (provenance)
On February 14, 2018, a business associate (BA), Fast Health Corporation, notified the covered entity (CE), that a third party hacked into to the BA's web server and was able to acquire the CE's protected health information (PHI) from August 14, 2017, to August 18, 2017. The breach affected 667 individuals and included dates of birth, names, photographs, length, weight, sex, and parents' names. To mitigate this breach and prevent a similar one from occurring, the CE terminated its relationship with the involved BA. The CE provided breach notification to HHS, affected individuals, and the media. As a result of OCR’s investigation, the CE updated its Breach Rule Notification policy and trained staff on its updated policy. OCR obtained documented assurances that the CE implemented the corrective action steps listed above.