HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of March 10, 2016.
- Organization as reported
- Cromwell Fire District, CT
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Paper/Films
- Submission date
- March 10, 2016
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14592, row:5731)
- Archived copy
- Held in the private archive (provenance)
Cromwell Fire District, the covered entity (CE), filed a breach report stating that a door to a storage room containing ambulance run reports was left propped open for approximately two hours. The OCR investigation revealed that the CE did not have policies and procedures in place at the time of the incident to conduct a breach risk assessment and had not conducted a breach risk assessment prior to filing the breach report with OCR. OCR provided technical assistance to the CE regarding conducting a breach risk assessment, breach notification requirements, and other provisions in the Privacy Rule. As a result of OCR’s investigation, the CE conducted a breach risk assessment and determined there was a low probability that the protected health information has been compromised based on the following factors: that the building received few visitors and was not known to have received a visitor during that time period, that the ambulance run reports appeared undisturbed, and that the situation was mitigated (the door was closed and locked) as soon as it was discovered. Thereafter, the CE determined that a breach had not occurred. In addition, as a result of OCR’s investigation, the CE revised and adopted additional policies and procedures, and implemented a new template business associate agreement.