HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Oct. 23, 2015.
- Organization as reported
- Florida Department of Health, Children's Medical Services, FL
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Paper/Films
- Submission date
- Oct. 23, 2015
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14679, row:5818)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE), Florida Department of Health, Children’s Medical Services, discovered that that an employee faxed an e-mail roster with all patients that needed medical supplies to each of their medical vendors. The policy is that the medical supply vendor only receives the names of patients to whom it will directly supply orthopedic supplies. The protected health information (PHI) on the e-mail roster included patients' names, dates of birth, and the insurance information of 523 individuals. The CE provided breach notification to HHS, affected individuals, and the media, and also posted substitute notice on its website. The CE also set up a toll free telephone number to answer questions. In response to the breach, the CE ceased the practice of sending daily rosters containing patient information to vendors. The CE sanctioned and re-trained the employee involved in this breach and retrained all employees on its HIPAA policies and procedures. OCR obtained assurances that the CE implemented the corrective actions listed above.