HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of April 13, 2018.
- Organization as reported
- MorshedEye, PLLC, KY
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Submission date
- April 13, 2018
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13858, row:4997)
- Archived copy
- Held in the private archive (provenance)
From January 10, 2018, through February 16, 2018, MorshedEye, the covered entity (CE), sent group emails to 762 patients to inform them of its new location; however, the emails were not blind copied, so recipients could view the names and email addresses of other patients. The protected health information (PHI) in the emails included names and email addresses. OCR provided technical assistance to the CE regarding the CE’s breach notification responsibilities, the definition of PHI, training, and business associate agreements. In response to OCR’s investigation, the CE revised its notice of privacy practices, added a complaint policy to its notice of privacy practices, developed a security and awareness training program, and compiled HIPAA guidance materials into a binder. The CE also performed an initial risk analysis, and sent breach notification to HHS, the affected individuals, and to the media. OCR obtained assurances that the CE implemented the corrective actions listed above.