HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of May 4, 2018.
- Organization as reported
- Baystate Family Dental, Inc., MA
- Entity type as reported
- Healthcare Provider
- Category as reported
Theft
- Location of information as reported
- Paper/Films
- Submission date
- May 4, 2018
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13829, row:4968)
- Archived copy
- Held in the private archive (provenance)
OCR opened an investigation of the covered entity (CE), Baystate Family Dental, after it filed a breach report stating that a former employee impermissibly accessed protected health information (PHI), potentially affecting all 4,800 patients at the facility. The types of PHI involved in the breach included patients' names, dates of birth, dates of service, claims information, payment information, diagnoses/conditions, lab results, and medications. The CE provided breach notification to HHS, affected individuals, and the media, and offered all affected individuals one free year of identity protection services. Following the breach, the CE immediately filed a police report and conducted an audit of all the paper charts and identified 19 missing charts. The CE hired an IT consultant who installed a new computer server with a new firewall. The CE upgraded physical security, retrained staff, and ensured that all passwords were disabled and changed. As a result of OCR’s investigation, the CE completed a risk analysis and risk management plan and implemented new security policies and procedures to ensure adequate safeguards for PHI.