HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Aug. 17, 2018.
- Organization as reported
- Monroe Operations, LLC d/b/a Newport Academy and Center for Families, TN
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Submission date
- Aug. 17, 2018
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13718, row:4857)
- Archived copy
- Held in the private archive (provenance)
On June 20, 2018, the covered entity (CE), Monroe Operations, LLC d/b/a Newport Academy and Center for Families, discovered that an employee’s email account was phished on or about February 22, 2018, and the hacker set an automatic forwarding rule in the employee’s email inbox. Upon discovery, the CE immediately terminated the forwarding rule and changed the email account password. The CE identified one spreadsheet in the employee’s email account that contained the protected health information (PHI) of 1,165 individuals, including demographic and health insurance information, dates of admission, and medical record numbers. The CE provided breach notification to HHS and the affected individuals; media notification was not required. In response to the breach, the CE adopted, revised, and implemented Security Rule and Breach Notification policies and procedures, performed a risk analysis, implemented a safeguard requiring employees to update their passwords regularly, and assigned a staff member the responsibility for ensuring employee participation in HIPAA training. OCR provided technical assistance on automating review of the CE's computer system and the importance of regular HIPAA training. OCR obtained assurance that the CE implemented the corrective actions listed above.