HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of March 17, 2016.
- Organization as reported
- Hospital for Special Surgery, NY
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Submission date
- March 17, 2016
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14583, row:5722)
- Archived copy
- Held in the private archive (provenance)
The Hospital for Special Surgery, the covered entity (”CE”) reported that an employee failed to safeguard the PHI by sending the email without using the BCC designation; in doing so, the email revealed the PHI of 647 patients participating in a research study to the other participants. The electronic protected health information (ePHI) included the individuals’ email addresses and general information regarding the research study. The CE provided notice to OCR and the affected individuals. Following the breach, the responsible employee was re-trained and provided with one-on-one, in-person HIPAA Privacy and Information Security Training. The CE also increased its in-person HIPAA training to at least three times a year. As a result of OCR’s investigation and technical assistance, the CE is expected to take corrective action based on OCR’s guidance. The CE is expected to revise its e-mail policy to incorporate additional safeguarding measures specifically tailored to the use of e-mail, and to retrain its staff on its revised policy.