HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of Dec. 11, 2015.
- Organization as reported
- Mary Ruth Buchness, MD, Dermatologist, P.C., NY
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Submission date
- Dec. 11, 2015
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14653, row:5792)
- Archived copy
- Held in the private archive (provenance)
The covered entity, Mary Ruth Buchness, MD, Dermatologist, P.C., reported that a workforce member sent an email with an Excel spreadsheet attachment that contained 14,910 patients’ protected health information to patients not intended to receive the attachment. The Excel spreadsheet included patients’ names, Social Security Numbers, dates of birth, gender, dates of last service and next appointment, telephone numbers, addresses, email addresses, marital status, head of household, employer/occupation and race/ethnicity. The covered entity provided breach notification to HHS, the media, and the affected individuals (including the offer of 12 months of credit monitoring and identity protection services at no cost to the affected individuals), and posted a notice to its website. Following the breach, the covered entity updated its HIPAA policies and procedures to prohibit sending an email to multiple recipients, and provided HIPAA training to its workforce. OCR obtained assurances that the covered entity implemented the corrective actions listed. OCR advised the covered entity that it is expected to conduct a risk analysis, implement a corresponding remediation plan, and sanction the workforce member responsible for the breach incident.