HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of Oct. 4, 2013.
- Organization as reported
- CaroMont Medical Group, NC
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Submission date
- Oct. 4, 2013
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15303, row:6442)
- Archived copy
- Held in the private archive (provenance)
On August 8, 2013, the covered entity (CE), CaroMont Medical Group, performed an internal audit that found an unencrypted email was sent by an employee on August 5, 2013. The employee emailed a spreadsheet to her personal email containing the following protected health information (PHI) for 1,310 individuals: patients’ names, dates of birth, medical record numbers, insurance providers, insurance numbers, diagnoses, and two Medicaid/Medicare numbers. The CE provided breach notification to HHS, affected individuals, and the media. In response to this incident, the CE reviewed its policies, updated its secure email policy, and required employees to attest to reviewing the new policy. The CE trained staff on data privacy and information security, and it implemented security controls for the encryption of all external emails containing an attachment. OCR obtained assurances that the CE implemented the corrective actions noted above.