HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of May 14, 2013.
- Organization as reported
- Dent Neurologic Institute, NY
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Submission date
- May 14, 2013
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15403, row:6542)
- Archived copy
- Held in the private archive (provenance)
A workforce member of the covered entity (CE), Dent Neurologic Group, LLP erroneously sent an unencrypted email with a spreadsheet containing 10,202 patients’ protected health information (PHI) to the wrong patients. The types of PHI in the spreadsheet included patients’ names, addresses, active/former patient status, dates of last appointments, scheduling codes, and physicians’ names. The CE provided breach notification to HHS, affected individuals and the media. Following the breach, the CE implemented an email security appliance that encrypts emails and filters incoming messages for malware, viruses and spam as well as filter outgoing messages for identifiers. The CE also updated its email encryption policy and procedure, implemented its policy and procedure for encryption and password protection of electronic documents, and updated its training program for handling emails. Additionally, the CE sanctioned, counseled and retrained the workforce member. As a result of OCR’s investigation and technical assistance, the CE provided evidence of its remediation of Windows XP devices as well as an updated risk analysis to incorporate physical safeguards, penetration testing, and a corresponding Security Risk Assessment Report. The CE is expected to conduct a risk analysis that addresses all potential risks and vulnerabilities in the entire operation and to implement a risk management plan and corresponding risk mitigation activities.