HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Sept. 19, 2012.
- Organization as reported
- Cabinet for Health and Family Services, Department for Community Based Services, KY
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Submission date
- Sept. 19, 2012
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15564, row:6703)
- Archived copy
- Held in the private archive (provenance)
An employee’s email account generated spam email which may have caused an unintentional release of protected health information (PHI) held by the Kentucky Cabinet for Health and Family Services (CFHS), Department for Community Based Services, the covered entity (CE). The CE provided breach notification to HHS, affected individuals, and the media, and posted a copy of its press release on the CHFS website with a toll-free number. As a result of OCR’s investigation, the CE required workforce members to sign an agreement to ensure that they understand their role in safeguarding PHI, including safeguarding from phishing attacks. The CE created a security video that all new hires are required to view and that is used for re-training of current staff. In addition, OCR obtained the CE’s HIPAA policies and procedures which complied with the requirements of the Privacy and Security Rules as well as the Breach Notification Rule.