HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of June 26, 2015.
- Organization as reported
- Meritus Medical Center, Inc., MD
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Electronic Medical Record
- Submission date
- June 26, 2015
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14766, row:5905)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE), Meritus Medical Center, reported that an audit revealed that a vendors’s employee (from Walgreens pharmacy) accessed the protected health information (PHI) of approximately 1,029 patients without a business need to do so. The types of PHI potentially accessed included demographic information such as names, dates of birth, medical record numbers and, in some instances health insurance information or Medicare identification numbers, as well as clinical information. The CE confirmed that it terminated the employee’s access to the electronic health record (EHR) and escorted the employee from the Meritus campus. The CE provided breach notification to HHS, the media, and affected individuals and offered credit monitoring. The CE implemented a new system for implementing technical measures so that the vendor’s employees’ access is limited to a separate system that interfaces with the EHR and pulls only limited patient information specifically related to those patients receiving Walgreens’ services. OCR obtained assurances that the CE implemented the corrective actions listed.