HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of April 28, 2015.
- Organization as reported
- Clinical Reference Laboratory, Inc., KS
- Entity type as reported
- Healthcare Provider
- Category as reported
Loss
- Location of information as reported
- Paper/Films
- Submission date
- April 28, 2015
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14811, row:5950)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE), Clinical Reference Laboratory, Inc. sent a parcel to Massachusetts Mutual Life that was opened and damaged during the mailing process by the United States Postal Services (USPS). The damaged parcel contained the protected health information (PHI) of approximately 864 individuals, including names, partial and full social security numbers, dates of birth, and clinical test codes. OCR received two other breach reports from the CE which involved the same or similar fact patterns as the breach report for this case. OCR consolidated these investigations into one breach compliance review. The CE investigated the breaches and concluded that the likelihood of misuse or further disclosure of the PHI was remote since the USPS confirmed that all unmatched pages were segregated and shredded. The CE provided breach notification to HHS, affected individuals, and notified appropriate authorities required by each jurisdiction that included an affected individual. The CE also offered affected individuals a free two-year subscription to credit monitoring services and credit report controls. Following the breach, the CE appointed a new privacy officer, who was required to complete HIPAA training, and verified that its workforce received HIPAA-related training. The CE also implemented a new breach reporting procedure and initiated the implementation of a secure online portal for clients to obtain PHI electronically. OCR obtained documentation evidencing that the CE implemented the corrective actions listed.