HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of Sept. 26, 2017.
- Organization as reported
- Kraig R. Pepper, D.O., P.A., TX
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Other
- Submission date
- Sept. 26, 2017
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14044, row:5183)
- Archived copy
- Held in the private archive (provenance)
Dr. Kraig R. Pepper, D.O., P.A. the covered entity (CE) reported that CoPilot Provider Support Services (CoPilot) suffered a data security incident exposing the protected health information (PHI) of 653 patients of the CE. The electronic PHI (ePHI) included patients’ names, addresses, dates of birth, claims information, diagnosis, and social security numbers. Following the breach, the CE provided breach notification to HHS, the media and affected individuals. As a result of OCR’s investigation, the CE executed a business associate agreement with CoPilot and revised its authorization form regarding permitted disclosures of PHI. The CE also provided one year of identity theft protection services to affected individuals. The CE is expected to perform a thorough and accurate risk analysis, establish a risk management plan, execute agreements with other business associates and document the impermissible disclosure of the affected patient’s PHI for accounting of disclosures purposes. Further, the CE is expected to perform a technical and non-technical evaluation in response to any environmental or operational changes affecting the security of ePHI that establishes the extent to which the CE’s security policies and procedures meet the requirements of the HIPAA Security Rule.