HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of April 27, 2018.
- Organization as reported
- Knoxville Heart Group, Inc., TN
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Submission date
- April 27, 2018
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13835, row:4974)
- Archived copy
- Held in the private archive (provenance)
On February 26, 2018, the covered entity (“CE”), Knoxville Heart Group, Inc., discovered that an unauthorized third party gained access to its email system through a phishing email. The email system contained the protected health information (PHI) of 15,008 individuals, primarily on “rounding lists,” which contained demographic, clinical and healthcare claims information, as well as the Social Security numbers, driver’s licenses, and financial account numbers for 130 individuals. Prior to OCR’s investigation, the CE immediately terminated the unauthorized access, reset the email account password, blocked all internal emails coming from the compromised email account, retrained all of its employees, provided free credit monitoring services and identity theft insurance to individuals whose financial information was compromised and created a secure email messaging platform for its practitioners to use on mobile devices. After the commencement of OCR’s investigation, the CE conducted a risk analysis and revised its Security Rule policies and procedures to prevent reoccurrence. OCR provided the CE with technical assistance of risk analysis and management plans as well as phishing prevention. The CE provided breach notification to HHS, the media, affected individuals, and on its website. OCR obtained assurances that the CE met its notification requirements and implemented the corrective actions listed above.