HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Jan. 18, 2018.
- Organization as reported
- Gillette Medical Imaging, WY
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Paper/Films
- Submission date
- Jan. 18, 2018
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13940, row:5079)
- Archived copy
- Held in the private archive (provenance)
On December 1, 2017, Gillette Medical Imaging, the covered entity (CE), discovered that its former business associate (BA) mistakenly mailed its medical billing records to other providers in the same geographical area. The breach affected over 500 individuals, and included names, addresses, social security numbers, dates of birth, insurance claims information, bank and credit card account numbers, diagnoses, lab results, and medications. The CE provided breach notification to affected individuals, the media, and HHS. OCR verified that the CE had proper BA agreements in place that restrict the BA’s use and disclosure of PHI and required the BA to safeguard all PHI. In resolving the breach, OCR provided the CE with technical assistance regarding reasonable safeguards, device and media controls, disclosures to business associates, business associate agreements, reportable breach assessment, and the Breach Notification Rule.