HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Jan. 6, 2018.
- Organization as reported
- DJO, LLC, CA
- Entity type as reported
- Healthcare Provider
- Category as reported
Loss
- Location of information as reported
- Paper/Films
- Submission date
- Jan. 6, 2018
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13948, row:5087)
- Archived copy
- Held in the private archive (provenance)
The covered entity, DJO, which is a supplier of durable medical equipment, prosthetics, orthotics, and supplies, reported a breach incident affecting 1,203 individuals when its business associate (BA), Total Orthopedics, lost paper forms containing protected health information (PHI). The types of PHI involved in the breach included demographic and clinical information, product order dates, health insurers, and health insurance indemnification numbers (which could possibly match an individual’s social security numbers). The CE was unable to identify the individuals affected. It provided breach notification through substitute notice posted on its website, to the media, and to HHS. OCR obtained assurances that the CE and BA took voluntary corrective actions, including attempting to identify the affected individuals, retraining employees, giving additional training to the new BA employee working on behalf of the CE, adding controls for tracking forms delivered and picked-up, increasing audits, and monitoring the inventory received.