HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Nov. 8, 2012.
- Organization as reported
- Maryville Academy, IL
- Entity type as reported
- Healthcare Provider
- Category as reported
Loss
- Location of information as reported
- Other Portable Electronic Device
- Submission date
- Nov. 8, 2012
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15538, row:6677)
- Archived copy
- Held in the private archive (provenance)
Three secondary back-up portable hard drives, which were maintained by the covered entity (CE), Maryville Academy, were removed from a locked room used as a secure area to maintain a secondary back-up copy of some electronic records for the CE’s services programs. The drives contained the electronic protected health information (ePHI) of approximately 3,897 individuals, including patients’ names, dates of birth, telephone numbers, social security numbers, addresses, diagnosis/conditions, financial claims information, medications, lab results, and other treatment information. The CE provided breach notification to HHS, affected individuals, and the media, and posted notification of the breach on its website. The CE also offered one year of free credit monitoring services to affected individuals. Following the breach, the CE revised its HIPAA policies and procedures and encrypted its back-up portable hard drives and other portable electronic devices. It also updated its practices regarding the physical storage of its back-up portable hard drives to include the use of a third party, off-site vendor and contracted with a third party vendor for long term offsite archive storage, and trained its workforce on any revised or newly implemented policies and procedures. OCR obtained documentation evidencing that the CE implemented the corrective actions listed.