HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of Oct. 21, 2011.
- Organization as reported
- Conway Regional Medical Center, AR
- Entity type as reported
- Healthcare Provider
- Category as reported
Loss
- Location of information as reported
- Other
- Submission date
- Oct. 21, 2011
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15754, row:6893)
- Archived copy
- Held in the private archive (provenance)
A business associate (BA) of the covered entity (CE), Conway Regional Medical Center, sent the CE two compact disks containing scanned medical records which were mislaid following receipt. The protected health information (PHI) involved in the breach included the demographic and financial information of 1,472 individuals. The CE provided breach notification to HHS, the media, and affected individuals. Following this breach, the CE instructed its BA to encrypt any removable media that contains PHI and hand deliver the removable media to the CE’s Medical Records Department. Further, the CE improved administrative safeguards by updating its policy and procedures, which now requires a signature of an employee in the receiving department when packages are delivered. Also, all workforce members in the department involved in the breach attended additional HIPAA training. As a result of OCR’s investigation, the CE no longer routinely sends PHI off site for scanning.