HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Oct. 22, 2018.
- Organization as reported
- Day Kimball Healthcare, CT
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Electronic Medical Record
- Submission date
- Oct. 22, 2018
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13650, row:4789)
- Archived copy
- Held in the private archive (provenance)
OCR opened an investigation of the covered entity (CE), Day Kimball Healthcare, after it filed a breach report stating that two former employees impermissibly used protected health information (PHI) to send solicitation letters to patients for their new place of employment. The potential size of the breach was 698 individuals and the types of PHI included names, addresses, phone numbers, marital status, providers, and appointment history. Following the breach, the CE immediately conducted a risk assessment and an audit of the former employees’ access. The CE contacted the new employer and requested they destroy or return any PHI and cease using it for inappropriate purposes. The CE provided breach notification to affected individuals, offered two years of identity protection services, and established a dedicated call center to respond to breach inquiries. As a result of OCR’s investigation, the CE provided updated copies of policies and procedures regarding breach notification, use and disclosures of PHI, and safeguarding PHI.