HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Nov. 30, 2018.
- Organization as reported
- CHI Health Care, Inc., MD
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Other Portable Electronic Device, Paper/Films
- Submission date
- Nov. 30, 2018
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13610, row:4749)
- Archived copy
- Held in the private archive (provenance)
On July 22, 2018, a former employee retained certain patient lists and other protected health information (PHI) after termination of employment and used some of this information to email a solicitation to approximately 722 patients of the covered entity (CE), offering nutrition services on October 4, 2018. The types of PHI involved in the incident included demographic and clinical information. The CE provided breach notification to HHS, affected individuals, and the media. The CE investigated the matter and ensured that all paper and electronic copies of the files were returned to the CE. The former employee has represented orally, and in a written and signed attestation, that the files were not downloaded, copied, retained, used, archived or re-disclosed to any other parties, other than in the email solicitation. Additionally, the CE has confirmed that its computer network and electronic medical record system are secure. Following the breach, the CE retrained its entire workforce members on two dates. The CE reviewed and updated its most recent risk assessment. OCR reviewed the notice sent to the affected individuals, as well as the security measures implemented to address risks and vulnerabilities. OCR obtained assurances that the CE implemented the corrective actions listed.