HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of July 26, 2016.
- Organization as reported
- Midwest Orthopedic Pain and Spine, MO
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Network Server
- Submission date
- July 26, 2016
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14467, row:5606)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE), Midwest Orthopedic, reported that it learned of a breach when notified by the Federal Bureau of Investigation (FBI) on May 27, 2016. Based on the information provided by the FBI the CE believes that the weakness or vulnerability that lead to the breach may have been a third party company that had access to the database for patient record transferring purposes. This breach affected the protected health information (PHI) of 29,153 individuals and included names, addresses, dates of birth, social security numbers, driver’s license numbers and clinical information. The CE provided breach notification to HHS, affected individuals, and the media. To resolve the issues raised in this matter, the CE changed the companies it uses for information technology, billing and electronic medical records. The new information technology company implemented new internet firewalls and began continuous monitoring of the CE's computer server for unauthorized access to electronic PHI and malware. The CE also retrained staff on HIPAA. OCR obtained documented assurances that the CE implemented the corrective action steps listed above..