HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Nov. 14, 2011.
- Organization as reported
- Mid Continent Credit Services, Inc., KS
- Entity type as reported
- Business Associate
- Category as reported
Theft
- Location of information as reported
- Other
- Submission date
- Nov. 14, 2011
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15737, row:6876)
- Archived copy
- Held in the private archive (provenance)
The covered entity's (CE), Lawrence Memorial Hospital, business associate (BA), performed a security update to the CE's website that potentially allowed the impermissible disclosure of 8,275 individuals' electronic protected health information (ePHI). The ePHI consisted of names, addresses, other demographic information, and credit card/bank account numbers. Upon discovering the breach, CE shut down its website, removed all identified cached pages containing ePHI, started actions to terminate the relationship with the BA, and updated its breach notification policy. CE also provided breach notification to affected individuals, HHS, and the media, and posted substitute notice on its website. It offered credit monitoring service to affected individuals. As a result of OCR's investigation, CE finalized its new breach notification policy, updated its BA contracts, and re-trained staff on its privacy, security, and breach notification polices.