HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of April 1, 2016.
- Organization as reported
- Aurora Health Care, Inc., WI
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Network Server
- Submission date
- April 1, 2016
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14573, row:5712)
- Archived copy
- Held in the private archive (provenance)
A business associate (BA), American College of Cardiology Foundation, inadvertently disclosed some of the covered entity’s (CE) patient information to one of its vendors without previously executing a BA agreement. The disclosure affecting approximately 869 individuals and the types of protected health information (PHI) included names, dates of birth, social security numbers, and registry identification numbers. The CE, Aurora Health Care, Inc., provided breach notification to HHS, affected individuals and the media. Following the breach, the CE investigated the breach to determine the root cause, halted the demonstration, destroyed the data, suspended access to the environment and reviewed and ensured that the testing environment was free of PHI. Additionally, the CE reviewed controls and access methods for vendors and disabled the “copy and paste” function to prevent copying of data from the registry environment and formalized procedures for transferring data from the live environment. OCR obtained documented assurances that the CE implemented the voluntary corrective actions listed above. OCR also reviewed the CE’s policies and procedures on safeguarding PHI.