HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of July 10, 2015.
- Organization as reported
- Howard University, DC
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Paper/Films
- Submission date
- July 10, 2015
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14758, row:5897)
- Archived copy
- Held in the private archive (provenance)
On May 6, 2015, business associates (BAs) sent out 1,445 misdirected collection letters on behalf of the covered entity (CE), Howard University Faculty Practice Plan. The types of protected health information (PHI) involved in the breach included names, account numbers, and dates of service. The BAs involved in the CE's collections efforts included California Healthcare Medical Billing, Inc. (“CHMB”) and JP Recovery Services, Inc. (“JPRS”). The CE provided breach notification to HHS, affected individuals, and the media, and posted substitute notification on its website. Following the breach, CHMB developed policies and procedures to enhance its quality assurance process for reports containing PHI. The JPRS IT staff worked closely with the CE to ensure that all future placement data files are verified as correct prior to downloading them into the collection system. The CE provided OCR with copies of the BA agreements between the CE and the two BAs. OCR obtained assurances that the CE implemented the corrective actions listed.