HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Oct. 23, 2012.
- Organization as reported
- First Step Counseling, Inc., NJ
- Entity type as reported
- Healthcare Provider
- Category as reported
Theft
- Location of information as reported
- Paper/Films
- Submission date
- Oct. 23, 2012
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15554, row:6693)
- Archived copy
- Held in the private archive (provenance)
From May 1, 2011, to August 5, 2011, two employees of the covered entity (CE), First Step Counseling, Inc., made photocopies of documents containing 638 patients' protected health information (PHI) and disclosed the documents to their attorney. The PHI included names, insurance numbers, diagnosis information, dates of birth, telephone numbers and social security numbers. Upon discovery of the breach, the CE hired attorneys to seek immediate return of all photocopies that contained CE's patients' PHI. The CE provided breach notification to HHS, affected individuals, and the media. As a result of OCR's investigation, the CE transferred to an electronic billing system which is password protected. In addition, the CE improved safeguards so that all patient files are locked and unlocked by the office manager, the front desk is protected by a window, and patients are not allowed to stand beside the receptionist desk. OCR obtained assurances that the CE implemented the corrective actions listed above.