HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of May 5, 2017.
- Organization as reported
- Jones Family Practice, P.A., NC
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Network Server
- Submission date
- May 5, 2017
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14191, row:5330)
- Archived copy
- Held in the private archive (provenance)
Jones Family Practice, the covered entity (CE), reported that an employee obtained the medical records of 742 patients on the day of her employment termination by using the CE’s electronic medical records (EMR) system. The protected health information (PHI) included patients’ names, lab results, progress notes, and patient summaries. As a result of the breach and OCR’s involvement, the CE developed a new procedure for terminating an employee’s access to its EMR system. The CE also created and executed a HIPAA compliant business associate agreement with its EMR provider, Quest Diagnostics Clinical Laboratories, Inc. The CE also provided breach notification to HHS, affected individuals, and the media. OCR obtained assurances that the CE implemented the corrective actions noted above.