HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of Nov. 16, 2010.
- Organization as reported
- Holy Cross Hospital, FL
- Entity type as reported
- Healthcare Provider
- Category as reported
Theft
- Location of information as reported
- Paper/Films
- Submission date
- Nov. 16, 2010
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15941, row:7080)
- Archived copy
- Held in the private archive (provenance)
A covered entity's (CE) employee impermissibly obtained copies of patient data sheets containing protected health information (PHI) and sold the PHI to a third party. The PHI included names, addresses, dates of birth, social security numbers, insurance information, and diagnoses affecting 38 individuals; however, the initial investigation addressed a report of approximately 1,500 affected individuals. The CE provided breach notification to 44,000 individuals (including those who were potentially affected), HHS and the media. In addition, free credit monitoring was offered. Following the breach, the CE cooperated with federal authorities, law enforcement, and the state health administration agency, and provided a report to a national accreditation organization. As a result of this incident, the CE convened a high level work group to oversee privacy and security issues and hired an expert forensic investigator to perform a risk assessment. The CE updated its privacy and security policies and procedures, developed a plan to adopt electronic health records and initiated a continuous review process including random HIPAA compliance audits. The CE also expanded its HIPAA training program for employees. OCR obtained written assurances that the CE implemented the corrective action listed above.