HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of July 23, 2014.
- Organization as reported
- Midwest Orthopaedic Center SC, IL
- Entity type as reported
- Business Associate
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Network Server
- Submission date
- July 23, 2014
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15037, row:6176)
- Archived copy
- Held in the private archive (provenance)
A former affiliate of the covered entity’s (CE) former business associate(BA), McKesson Corporation, that provided specialized billing services, unintentionally made records containing patient information potentially accessible on the Internet. The protected health information (PHI) of approximately 680 individuals was accessible using very specific Google search terms between December 1, 2013 and April 17, 2014. The former BA immediately safeguarded the information and made it inaccessible on the Internet. The former BA confirmed that the web server was properly removed from public Internet access, confirmed from its former affiliate that the data at issue was destroyed, contacted Google to ensure all caches pages were destroyed, and confirmed the information could not be accessed through any web search. The former BA also confirmed with its former affiliate that no other information was available via the computer server at issue or any other server. The CE confirmed that the former BA’s policies related to data security were in compliance with the CE’s data security requirements. The CE provided breach notification to HHS, affected individuals, and the media, and offered credit monitoring to the affected individuals. OCR obtained written assurances that the CE and BA implemented the corrective actions listed above.