HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of March 30, 2018.
- Organization as reported
- Guardian Pharmacy of Jacksonville, FL
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Submission date
- March 30, 2018
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13874, row:5013)
- Archived copy
- Held in the private archive (provenance)
Guardian Pharmacy of Jacksonville, the covered entity (CE), reported that an employee fell victim to an email phishing scheme. The breach affected 11,521 individuals. The protected health information (PHI) involved included names, addresses, dates of birth, treatment and diagnosis information, Social Security numbers, drivers’ license numbers, insurance information, and financial information. The CE provided breach notification to HHS, all affected individuals, the media, and posted the details of the breach incident on its website. Additionally, in response to this incident and OCR’s investigation, the CE adopted new password length and complexity requirements, implemented an account lockout mechanism, increased firewall protections and patch management, sanctioned the employee whose email account was affected, and retrained its staff. Guardian adopted and implemented a new security policy. OCR obtained assurances that the CE implemented the corrective actions noted above.