HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Sept. 1, 2016.
- Organization as reported
- Franciscan Health, Highline Medical Center, WA
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Network Server
- Submission date
- Sept. 1, 2016
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14438, row:5577)
- Archived copy
- Held in the private archive (provenance)
A business associate (BA) inadvertently left files containing the covered entity’s (CE) patient information accessible via the internet from mid-April 2016 to June 13, 2016. The BA assured the CE, CHI Franciscan Health, Highline Medical Center, that it secured the files on June 13, 2016. The types of ePHI involved included patients names, dates of service, health insurance information, and social security numbers and affected approximately 18,399 individuals. OCR reviewed the applicable BA agreement that was in place at the time of the breach. Following the breach, the CE discontinued its BA relationship with the BA. In addition, the BA provided validation that it deleted all of the files in its computer systems that contained information about the CE’s patients. OCR obtained assurances that the CE notified all affected individuals, submitted notification to the media offered free credit monitoring services to all living affected individuals, and created a 24/7 call center for patients and other concerned individuals, so that such individuals could get up-to-date information on the breach and receive assistance as needed.