HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Oct. 7, 2016.
- Organization as reported
- Genesis Physical Therapy, Inc., CA
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Electronic Medical Record
- Submission date
- Oct. 7, 2016
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14398, row:5537)
- Archived copy
- Held in the private archive (provenance)
Rehab Billing Solutions (RBS) is a business associate (BA), which handled the billing and medical records, for the covered entity (CE), Genesis Physical Therapy, Inc. A third party impermissibly accessed protected health information (PHI) by exploiting a vulnerability in the BA’s application that stores scanned documents. The demographic and/or financial information of 2,245 individuals was potentially involved in the breach. The CE ended the BA agreement with this BA on August 31, 2016, and did not have access to the application at the time of the breach. The CE provided breach notification to HHS, affected individuals and the media pursuant to the Breach Notification Rule. In response to OCR’s investigation, the CE provided OCR with a copy of its BA agreement with RBS, which contained satisfactory assurances regarding safeguarding PHI pursuant to the requirements of the Privacy and Security Rules.