HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of Jan. 11, 2014.
- Organization as reported
- Cook County Health & Hospitals System, IL
- Entity type as reported
- Healthcare Provider
- Category as reported
Other
- Location of information as reported
- Submission date
- Jan. 11, 2014
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15209, row:6348)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE), Cook County Health and Hospital Systems, reported that on November 12, 2013, as part of a public health project between the CE and another academic medical center, a physician at the CE sent an unencrypted email with an excel attachment to a collaborator outside the CE’s firewall. The attachment contained the protected health information (PHI) of 22,511 individuals. The attachment was not encrypted as required by organizational policy. The types of PHI involved in the breach included demographic information and lab results. The CE provided breach notification to HHS, affected individuals, and the media. The CE disciplined the employee with a 14 day suspension, implemented a new email security program, and retrained its employees and staff on the program. OCR obtained documentation from the CE that it implemented the corrective actions listed above.