HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Nov. 12, 2013.
- Organization as reported
- Hospice of the Chesapeake, MD
- Entity type as reported
- Healthcare Provider
- Category as reported
Theft
- Location of information as reported
- Submission date
- Nov. 12, 2013
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15266, row:6405)
- Archived copy
- Held in the private archive (provenance)
Contrary to the covered entity's (CE) established policy, an employee emailed spreadsheets containing the electronic protected health information (ePHI) of 7,035 patients to a personal email account, and a third party may have viewed the spreadsheets. The PHI included names, addresses, conditions, and diagnoses. Following the breach, the CE hired an independent computer forensics firm which conducted an independent investigation. The investigation uncovered another spreadsheet containing the PHI of 571 additional patients in the employee's personal email account. The CE provided breach notification to affected individuals, the media, and HHS, and posted substitute notice on its website. The CE applied sanctions for violating its policy and terminated the responsible employee. As a result of OCR's investigation, OCR obtained assurances that the CE has periodically conducted risk assessments to assess vulnerabilities to ePHI in its computer systems.