HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of July 19, 2013.
- Organization as reported
- GEO Care, LLC, FL
- Entity type as reported
- Healthcare Provider
- Category as reported
Theft
- Location of information as reported
- Desktop Computer
- Submission date
- July 19, 2013
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15360, row:6499)
- Archived copy
- Held in the private archive (provenance)
The FBI notified the covered entity (CE), GEO Care, that a GEO Care employee, inappropriately accessed the patient admission reports of approximately 710 patients at South Florida State Hospital and provided them to a third party, the employee's cousin, without authorization. The employee's cousin then attempted to sell the reports for an illegal purpose. The protected health information (PHI) involved in the breach included names, dates of birth, social security numbers, admission dates, discharge dates, and patients' unit names. The CE provided breach notification to HHS, the media, and posted substitute notice on its website. It also offered identity theft protection to the affected individuals. The responsible staff member was terminated according to the CE's policy and has also been criminally indicted. Following the breach, the CE improved safeguards by limiting the use of full social security numbers, restricting access to documents, and performing weekly audits of those workforce members who access documents with full social security numbers. Additionally, the CE updated its privacy and security policies and procedures and developed new policies and procedures. It also revised its policies for employee access to electronic PHI based on job title and function, and provided retraining to employees regarding access and disclosure of PHI. OCR obtained assurances that the corrective actions listed above were completed.