HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of July 27, 2018.
- Organization as reported
- Longwood Orthopedic Associates, Inc., MA
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Submission date
- July 27, 2018
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13738, row:4877)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE), Longwood Orthopedic Associates, disclosed protected health information (PHI) to a printing vendor, Fenway Printing Group, without first executing a business associate (BA) agreement. The breach included the names, addresses, and medical record numbers of approximately 10,000 individuals. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE ensured that the BA securely destroyed the PHI, executed a BA agreement with Fenway, and reviewed all of its existing vendors to ensure the existence of executed BA agreements where necessary. In addition, the CE reviewed and revised its HIPAA training program. OCR obtained assurances that the CE implemented the corrective action steps noted above.