HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of July 13, 2015.
- Organization as reported
- Mayo Clinic Health System- Red Wing, MN
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Electronic Medical Record
- Submission date
- July 13, 2015
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14756, row:5895)
- Archived copy
- Held in the private archive (provenance)
On May 18, 2015, an access audit revealed that the covered entity's (CE) employee accessed patients’ electronic medical records beyond the scope of authorized access and assigned job responsibilities. The CE discovered that the unauthorized access dated back to 2009. The breach affected approximately 601 individuals and the types of protected health information (PHI) involved in the breach included patients' diagnoses and medical conditions. The CE provided breach notification to HHS, affected individuals, and the media. During OCR’s investigation, the CE retrained the revenue department in its Red Wing SE Minnesota Region on its privacy rules. OCR obtained written assurances that the CE implemented the corrective action steps listed above.