HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Sept. 7, 2018.
- Organization as reported
- Boston Health Care for the Homeless Program, MA
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Paper/Films
- Submission date
- Sept. 7, 2018
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13698, row:4837)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE), Boston Health Care for the Homeless Program, inadvertently left the clinic door unlocked after hours and staff discovered a guest of the adjacent shelter sleeping in an exam room the following morning. There was no evidence that the guest accessed protected health information (PHI); however, the PHI of approximately 861 individuals was stored in the clinic, including demographic and clinical information. As a result of OCR’s investigation, the CE updated a relevant administrative safeguards policy and retrained staff on the revisions, implemented additional physical and technical safeguards, and notified potentially affected individuals pursuant to the Breach Notification Rule. OCR provided technical assistance to the CE regarding the timeliness requirements for notification to OCR and individuals. OCR also reviewed the CE’s relevant policies and procedures and they appear to comply with the HIPAA Rules.