HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of March 29, 2019.
- Organization as reported
- Burrell Behavioral Health, MO
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Network Server
- Submission date
- March 29, 2019
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13480, row:4619)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE), Burrell Behavioral Health (BBH), reported that its business associate (BA) had not properly secured a web portal containing medical records. This breach affected 67,493 individuals. The protected health information (PHI) involved included names, addresses, dates of birth, social security numbers, clinical information, diagnoses/conditions, lab results, and medication information. The CE immediately contacted its BA to remove access to its unsecured portal and initiated an investigation to determine the scope of the incident. The investigation revealed that links inside the portal led to a folder hosted by another entity (a contractor to the BA). The system was not configured to require authentication or enable auditing. The CE notified affected individuals, OCR, and the media of this breach incident. BBH established a toll free call center and offered affected individuals identity monitoring and protection services and terminated its relationship with the BA. OCR obtained assurances that the covered entity implemented the corrective actions noted above.