HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Feb. 17, 2017.
- Organization as reported
- Family Service Rochester, MN
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Network Server
- Submission date
- Feb. 17, 2017
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14268, row:5407)
- Archived copy
- Held in the private archive (provenance)
On January 26, 2017, the covered entity (CE), Family Service Rochester, discovered that an unauthorized user had accessed its computer server, which contained the names, addresses, dates of birth, and social security numbers of approximately 17,037 patients. On the day the CE discovered the breach, it terminated all access to both its remote desktop and the compromised “programs” account. The CE also reviewed all accounts with access to the computer drive to ensure compliance with its password policy. The CE ensured that all accounts that had not been used in the past 90 days were disabled. The CE provided breach notification to HHS, affected individuals, and the media. As part of its risk analysis and risk management process, the CE also reviewed and revised its HIPAA policies and procedures. OCR obtained documented assurances that the CE implemented the corrective actions listed above.