HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of July 21, 2017.
- Organization as reported
- Massachusetts Department of Public Health - Tewksbury Hospital, MA
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Electronic Medical Record
- Submission date
- July 21, 2017
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14118, row:5257)
- Archived copy
- Held in the private archive (provenance)
An employee of Tewksbury Hospital, a covered component of the Massachusetts Department of Public Health, the covered entity (CE), impermissibly access the electronic medical records of 1,176 individuals. The types of protected health information (PHI) involved included demographic and clinical information. The CE provided breach notification to HHS, affected individuals, and the media and posted substitute notice on its website. The employee resigned before the CE could apply sanctions. Following the breach, the CE removed sensitive information from the patient summary page in its electronic medical record (EMR) system, increased restrictions to EMR access based on workforce member role and work location, and provided additional training to all its employees regarding role-based access and the HIPAA minimum necessary requirements. OCR reviewed the CE’s policies and procedures and obtained assurances that the CE implemented the corrective actions listed above.