HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Nov. 8, 2013.
- Organization as reported
- North Carolina Department of Health and Human Services - Division of State Operated Health Care Facilities, NC
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Other
- Submission date
- Nov. 8, 2013
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15270, row:6409)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE), North Carolina Department of Health and Human Services Division of State Operated Health Care Facilities, impermissibly disclosed the protected health information (PHI) of 1,315 individuals by exposing their PHI on its website, NC Open Book, without authorizations. The PHI involved in the breach included patient payment information, names, addresses, and facility names, which were erroneously posted as vendor payments on the website. The CE removed the information from the website immediately upon discovery. The CE also provided breach notification to HHS, affected individuals, and the media, and placed substitute notice on its website. In addition, the CE provided a toll-free phone number for affected individuals to obtain additional information. Following the breach the CE implemented procedures limiting the types of personally identifiable information that are disclosed in the accounting system. Additionally, the CE improved safeguards for all HIPAA-related documents and email correspondence containing PHI. Finally, the CE implemented a procedure that requires prior review of any data being released to the public and redaction of confidential information. OCR obtained assurances that the corrective actions listed above were completed.