HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of July 11, 2016.
- Organization as reported
- Lasair Aesthetic Health, P.C., CO
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Submission date
- July 11, 2016
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14484, row:5623)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE), Lasair Aesthetic Health, P.C., reported that on May 11, 2016, its former employee used her mobile phone to forward 5 emails containing the electronic protected health information of 1,835 patients to her personal email account. The emails consisted of two lists of patients that included names and balances or credit amounts, two emails with pictures that included names of the patients pictured, and one email documenting a patient’s reaction to a medical service. The former employee tendered her resignation on May 10, 2016, and the CE changed all of her passwords within 20 minutes of receiving her notice; however, the breach occurred the next day, because the change in passwords did not update to her mobile phone. The CE provided breach notification to affected individuals, HHS, and the media. Following the breach, the CE created new privacy and security policies and procedures, including a new termination checklist; re-trained its staff; instituted background check procedures for all staff; switched email service to a new provider with increased security controls; and removed remote access capability from the majority of its staff. OCR provided the CE with relevant technical assistance.