HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of May 4, 2017.
- Organization as reported
- Mecklenburg County, North Carolina, NC
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Other Portable Electronic Device
- Submission date
- May 4, 2017
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14194, row:5333)
- Archived copy
- Held in the private archive (provenance)
Mecklenburg County, North Carolina, the covered entity (CE), disclosed multiple digital storage disks (i.e., DVDs) that contained protected health information (PHI) when it responded to the public records requests of two media outlets. The breach affected 2,041 individuals and the PHI included patients’ names, information regarding the services received, lab results, medical record numbers, patients’ addresses, and dates of birth. The CE provided timely breach notification to HHS, to affected individuals, and to the media. The CE also posted notification about the breach to its website. In response to the breach, the CE revised its HIPAA policies and procedures, revised training modules, retrained staff, and allocated funds to purchase software and hardware to improve its management of future public records requests. OCR provided technical assistance to the CE regarding the required elements of breach notification notices. OCR obtained assurances that the CE implemented the corrective actions listed above.