HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Sept. 2, 2016.
- Organization as reported
- Burrell Behavioral Health, MO
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Submission date
- Sept. 2, 2016
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14436, row:5575)
- Archived copy
- Held in the private archive (provenance)
Between July 6 and 7, 2016, an unauthorized individual(s) accessed the email account of an employee at the covered entity (CE), Burrell Behavioral Health, and sent thirteen (13) personal emails to an account believed to be the employee’s ex-boyfriend. The email account which was impermissibly accessed contained electronic protected health information (ePHI) for 7,748 patients. The ePHI included names, treatment, social security numbers, and financial information. The CE provided breach notification to HHS, affected individuals, and the media, and posted notice on its website. The CE directed a third-party forensic information technology investigator to determine the cause and severity of the breach. The investigation concluded that only the one employee’s email account was breached. The CE disabled email internet access globally for all employees. The CE also sent out educational documents and reminders to all employees about password security and best practices for HIPAA and network security. The CE also provided one year of identity and credit protection to affected individuals. OCR obtained assurances that the CE took the voluntary corrective actions listed above.