HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of May 26, 2017.
- Organization as reported
- Beacon Health System, IN
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Electronic Medical Record
- Submission date
- May 26, 2017
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14179, row:5318)
- Archived copy
- Held in the private archive (provenance)
Beginning on or around March 1, 2014, an employee of the covered entity (CE), Beacon Health System, impermissibly accessed Emergency Room (ER) patient records while working in the billing department. The employee had access to protected health information (PHI) for 1,239 ER patients, including addresses, dates of birth, names, social security numbers, ages, room numbers, claims information, billing, accounts, invoices, health insurance, illness, and chief complaint. The CE provided breach notification to HHS, affected individuals and the media. It also provided credit monitoring to affected individuals. Following the breach, the CE sanctioned the employee in accordance with its sanction policy. During our investigation, we found that a large number of the CE's staff either did not complete HIPAA training or only completed a portion of the training for 2016. OCR requested that the CE update its HIPAA training policy and audit policy. In response, the CE provided OCR with documentation of actions it took, including redrafting its HIPAA training policy, updating its audit policy and providing evidence of daily audits and log runs.