HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of Dec. 7, 2012.
- Organization as reported
- Coastal Behavioral Healthcare, Inc., FL
- Entity type as reported
- Healthcare Provider
- Category as reported
Theft
- Location of information as reported
- Paper/Films
- Submission date
- Dec. 7, 2012
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15516, row:6655)
- Archived copy
- Held in the private archive (provenance)
OCR opened an investigation of the covered entity (CE), Coastal Behavioral Healthcare, Inc., after it reported that four pages containing protected health information (PHI) were recovered by local law enforcement during a motor vehicle traffic stop. The CE indicated the four pages were likely part of a larger report and may have containing the PHI of 4,907 individuals. The PHI involved in the breach included names, social security numbers, dates of birth, and other identifiers. The CE provided breach notification to the affected individuals, HHS, and the media. Following the breach, the CE hired a cybersecurity firm to perform a network audit and to conduct a security risk assessment. The CE also improved safeguards by restricting physical access to its information technology department, implementing a new electronic health record system, and disabling the ability to print reports from its database containing data similar to the report that was the subject of the breach. OCR obtained assurances that the CE implemented the corrective action listed above.