HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of April 16, 2018.
- Organization as reported
- Cornerstone Foot & Ankle, NJ
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Submission date
- April 16, 2018
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13854, row:4993)
- Archived copy
- Held in the private archive (provenance)
Cornerstone Foot & Ankle, the covered entity (CE), discovered that a former staff member sent spreadsheets containing protected health information (PHI) to her personal email account. The breach affected 533 individuals and the PHI involved included names, insurance information, claims information, dates of treatment, and current procedural terminology (CPT) codes. The CE provided breach notifications to HHS, all affected individuals, and the media. Following the breach, the covered entity conducted an internal investigation including a full enterprise-wide audit. Cornerstone Foot & Ankle implemented mandatory encryption on all outgoing e-mails, obtained a signed and notarized statement from the former employee stating that all emails sent to her personal email account had been deleted, and retrained staff on the provisions of the Privacy and Security Rules. OCR obtained assurances that the covered entity implemented the corrective actions noted above.