HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of May 28, 2015.
- Organization as reported
- BUFFALO HEART GROUP, NY
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Electronic Medical Record
- Submission date
- May 28, 2015
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14788, row:5927)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE), Buffalo Heart Group reported a breach when a staff physician provided her password to a third party, who then remotely accessed the covered entity’s electronic medical record (EMR). The breach resulted in the disclosure of 567 individuals’ electronic protected health information (ePHI). The ePHI included names, dates of birth, addresses, demographic and clinical information. The CE provided breach notification to HHS, affected individuals and the media. OCR conducted an investigation, which resulted in substantial technical assistance. The CE is expected to conduct a risk analysis that addresses all potential risk and vulnerabilities in the entire operation and corresponding risk mitigation activities, establish a risk management plan, implement a security awareness and training program to include on-going training, implement audit controls, and conduct regular information system activity reviews.