HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of June 19, 2015.
- Organization as reported
- Central Brooklyn Medical Group, PC, NY
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Other
- Submission date
- June 19, 2015
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14770, row:5909)
- Archived copy
- Held in the private archive (provenance)
Between January 1, 2015 and April 18, 2015, a physician employed by the covered entity (CE), Central Brooklyn Medical Group, PC, impermissibly disclosed the protected health information (PHI) of approximately 500 patients to his former medical assistants via facsimile on multiple occasions. On one occasion, the physician accidentally transposed digits in the intended facsimile number and disclosed the PHI of 88 patients to an unrelated third party. The types of PHI involved in the breach included patients’ names, ages, sex, appointment dates, times and reasons for visits, treating physician’s names, and medical conditions. The CE sent breach notification letters to 4,135 patients who had been scheduled to see the physician in the year prior to the breach because the CE could not identify which specific patients were affected; however, they were most likely within this group. The CE also provided breach notification to HHS and the media. Upon discovery of the breach, the CE confirmed the destruction of any PHI possessed by the unrelated third party and the medical assistant and sanctioned the physician. The CE also retrained its workforce members regarding HIPAA compliance, including the CE’s policy regarding communications via facsimile. OCR obtained assurances that the CE implemented the corrective actions listed above. In addition, the CE reported the physician to the State Office for Professional Medical Conduct.