HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Aug. 15, 2012.
- Organization as reported
- Heartland Pathology Associates, P.A., FL
- Entity type as reported
- Healthcare Provider
- Category as reported
Theft
- Location of information as reported
- Other Portable Electronic Device
- Submission date
- Aug. 15, 2012
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15583, row:6722)
- Archived copy
- Held in the private archive (provenance)
Heartland Pathology Associates, P.A., the covered entity (CE), discovered that its past business associate (BA), Medical Business Service, Inc., suffered a breach when an employee downloaded protected health information (PHI) to a portable computer drive and provided the drive to a third party. The breach affected 1,175 individuals and included patients' names, addresses, telephone numbers, social security numbers, dates of birth, insurance carriers, insurance policy numbers, physicians' name, diagnosis information, medical record numbers, account numbers, admission and discharge dates, and gender. The CE delayed providing breach notification due to a law enforcement investigation. Once given approval, the CE timely sent breach notification to HHS, affected individuals, and the media and posted substitute notification online. The CE contracted with Florida Hospital Heartland Medical Center (“Hospital”) for annual HIPAA training and for use of a computer maintained and monitored by the Hospital’s information technology department. The CE received assurances that PHI maintained by its BA was destroyed. OCR obtained assurances that the CE has implemented the corrective actions listed above.