HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of April 18, 2016.
- Organization as reported
- Florida Hospital Medical Group, FL
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Submission date
- April 18, 2016
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14554, row:5693)
- Archived copy
- Held in the private archive (provenance)
Florida Hospital Medical Group, the covered entity (CE), reported that providers dictated health information to its transcription service company, Data Tray, which transmitted the health information back to the providers using an unencrypted email account. The protected health information (PHI) involved included the names, diagnoses, conditions, and medications prescribed of 1,906 individuals. The CE notified HHS, affected individuals, the media, offered complimentary credit monitoring services, and set up a toll free number for questions and concerns. During OCR’s investigation, we found that the CE did not have a business associate agreement (BAA) in place with Data Tray. In its mitigation efforts, the CE ended its relationship with Data Tray and entered into a BAA with a new transcription vendor. The CE also implemented additional administrative safeguards to better protect its PHI and retrained its staff. OCR obtained assurances that the CE implemented the corrective actions noted.