HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of March 20, 2017.
- Organization as reported
- Highland Rivers Community Service Board, GA
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Paper/Films
- Submission date
- March 20, 2017
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14237, row:5376)
- Archived copy
- Held in the private archive (provenance)
A staff member of Highland Rivers Community Service Board, the covered entity (CE), sent incorrect information to the CE’s billing agent. Relying on the incorrect information, the billing agent mailed statements to 967 individuals, some of which contained protected health information (PHI) for the wrong patients. The statements contained the individual’s name, account number, dates of service, fess for service, and cumulative balance. Following the incident, the CE sanctioned the staff member involved, provided HIPAA retraining, and reviewed its policies and procedures. As a result of OCR’s investigation, the CE created a new, more secure written procedure for sharing PHI with vendors. The CE also provided breach notification to HHS, the affected individuals, and the media. Further, in response to technical assistance provided by OCR, the CE provided substitute notice on its website and in person, when individuals next visited the CE for services.