HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of July 13, 2018.
- Organization as reported
- Central New York Cardiology, NY
- Entity type as reported
- Healthcare Provider
- Category as reported
Loss
- Location of information as reported
- Paper/Films
- Submission date
- July 13, 2018
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13752, row:4891)
- Archived copy
- Held in the private archive (provenance)
The U.S. Postal Service found unsecured printed appointment lists dated October 2017 in the covered entity’s (CE) mail receptacle and returned them to the CE via priority mail package. The protected health information (PHI) involved in the incident included 824 patients’ names, dates of birth, type of appointment, reason for appointment, phone numbers and insurance information. The CE provided breach notification to HHS, affected individuals and the media. Following the breach, the CE developed and implemented new procedures to reduce the need to print and carry PHI between worksites, improved safeguards, executed new business associate agreements with all applicable vendors/contractors, and ensured that staff completed HIPAA training. OCR obtained assurances that the CE implemented the corrective actions listed above.