HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Oct. 25, 2011.
- Organization as reported
- Indiana University School of Optometry, IN
- Entity type as reported
- Healthcare Provider
- Category as reported
Theft
- Location of information as reported
- Network Server
- Submission date
- Oct. 25, 2011
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15750, row:6889)
- Archived copy
- Held in the private archive (provenance)
A doctor's letters and reports were exposed on the Internet for one month after the security configuration of the covered entity's (CE) computer server was changed. The electronic protected health information (ePHI) of 757 individuals appearing on the Internet included patient names, birth dates, medical histories, diagnoses, and treatment plans. Following the breach, the CE identified and blocked the internet protocol (IP) address that was allowing access to ePHI over the Internet, removed the web portal that was facilitating access, and restored the affected server to its previous security configuration. As a result of OCR's investigation, the CE implemented monitoring and reporting of electronic information systems that transmit ePHI. OCR obtained assurances that breach notification was provided to affected individuals, the media, and HHS.