HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Feb. 11, 2019.
- Organization as reported
- Kentucky Counseling Center, LLC, KY
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Electronic Medical Record
- Submission date
- Feb. 11, 2019
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13538, row:4677)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE), Kentucky Counseling Center, LLC, discovered that a former contractor sent a former staff member an email containing a list of 16,440 of the CE’s patients. The email contained protected health information (PHI), including demographic and health insurance information. The CE provided breach notification to HHS, affected individuals, and the media and also notified the FBI. In response to the breach, the CE adopted encryption technology, implemented two-factor authentication and strengthened password requirements. In addition, the CE retrained contractors and employees on HIPAA and added additional controls to its electronic medical record (EMR) system. The CE conducted a risk assessment and developed new policies and procedures. OCR obtained assurances that the CE implemented the corrective actions listed above.