HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Sept. 16, 2016.
- Organization as reported
- CHI Franciscan Health, St. Clare Hospital and St. Joseph Medical Center, WA
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Electronic Medical Record
- Submission date
- Sept. 16, 2016
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14421, row:5560)
- Archived copy
- Held in the private archive (provenance)
On July 22, 2016, CHI Franciscan Health, the covered entity (CE), learned that an employee-physician had been impermissibly accessing St. Clare Hospital and St. Joseph Medical Center patient information since July 1, 2015, to try to expand the physician’s client base. Approximately 2,818 individuals were affected by this breach incident. The types of electronic protected health information (ePHI) involved included clinical information, such as diagnoses, conditions, lab results, medications, and other treatment information. The CE provided breach notification to affected individuals, the media and HHS, and also posted information about the breach on its website. The CE created a call center for patients and other concerned individuals, so that such individuals could get up-to-date information on the breach incident and receive assistance as needed. In addition, the CE sanctioned the responsible physician in accordance with its HIPAA sanctions policy and retrained its workforce members on HIPAA, which included a session on “Acceptable Uses and Disclosures of PHI for Physicians.” OCR obtained assurances that the CE implemented the corrective actions described above.