HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of Nov. 29, 2013.
- Organization as reported
- City of Chicago, IL
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Network Server
- Submission date
- Nov. 29, 2013
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15250, row:6389)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE) mistakenly permitted protected health information (PHI) to be viewable on the Internet when users uploaded files without changing the default permission settings for the folders containing the files. As a result, Google was able to detect and cache the PHI in the uploaded folders. Approximately 2,080 individuals were affected by this breach. The types of PHI involved in the breach included students’ names, birthdates, genders, identification numbers, vision exam dates, diagnoses, and schools. The CE provided breach notification to HHS, the parents and guardians of affected individuals, and the media. It also posted notice on its website. The CE took action to remove the files containing PHI from its network and compiled a list of files along with the associated unique record locator numbers (URLs) and cached URLs. The CE contacted Google to request removal of the data from the cache and the archives, and Google confirmed that the data was removed. OCR obtained assurances that the CE implemented the corrective actions listed above.