HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of Nov. 8, 2016.
- Organization as reported
- Consultants in Neurological Surgery, LLP, FL
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Paper/Films
- Submission date
- Nov. 8, 2016
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14371, row:5510)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE), Consultants in Neurological Surgery, discovered on September 9, 2016, that an employee stole patients’ credit card information for her own personal use while processing the patients’ co-payments. The employee had access to the demographic, clinical, and financial information of 800 individuals. The CE provided breach notification to HHS, affected individuals, and the media. OCR provided technical assistance to the CE regarding the Breach Notification Rule and the Security Rule. In response to the beach, CE altered its policies for handling credit card payments and limited the types of information maintained in its practice management software. In addition, the CE retrained its workforce and revised its policies and procedures. OCR obtained assurances that the CE implemented the corrective actions listed above. The CE also sanctioned the involved employee (which in this case included termination of employment).