HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of July 14, 2016.
- Organization as reported
- Blaine Chiropractic Center, MN
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Network Server
- Submission date
- July 14, 2016
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14480, row:5619)
- Archived copy
- Held in the private archive (provenance)
On or around May 10, 2016, the covered entity’s (CE) office manager noticed that its computer server was crashing and programs were running slowly. The CE found that its new patient record management system created and hid an administrative account that was using a very weak and predictable user ID and password. This administrative account was used to hack the CE’s server. The protected health information (PHI) on the server included patients’ full names, addresses, telephone numbers, appointment activity, clinical care notes, insurance information and for 51 of these affected individuals, their social security numbers. Approximately 1,945 individuals were affected by this breach. The CE provided breach notification to HHS, affected individuals, and the media and offered credit monitoring free of charge for one year. Following the breach, the CE removed the unauthorized account and application. The CE retained a forensic expert and provided OCR with a copy of the forensic report. OCR obtained assurances that the CE implemented the corrective actions listed above.