HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Oct. 31, 2014.
- Organization as reported
- Memorial Healthcare System, FL
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Submission date
- Oct. 31, 2014
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14943, row:6082)
- Archived copy
- Held in the private archive (provenance)
An employee of the covered entity (CE) sent a group email to current and former patients inviting them to a cancer awareness event and mistakenly failed to mask the recipients' email addresses. This breach affected the protected health information (PHI) of 1,782 individuals by exposing names and an implicit indication that they may have received cancer treatment. The CE recalled the email and immediately investigated the breach. The CE provided breach notification to HHS, affected patients, and the media, and posted substituted notice on its website. The CE established a call center to answer questions for its patients. The CE counseled the involved employee, and the employee’s supervisor reinforced to all department employees instructions regarding the use of group emails and the importance of keeping patients’ emails confidential. The CE reviewed and revised its privacy program in March 2015 and September 2015, which included guidelines for security of electronic PHI/email. In addition, the CE confirmed that it uses an encryption program to ensure the security and integrity of data. OCR obtained assurances that the CE implemented the corrective actions listed above.