HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of July 27, 2017.
- Organization as reported
- Northwest Behavioral Healthcare Services, OR
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Submission date
- July 27, 2017
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14112, row:5251)
- Archived copy
- Held in the private archive (provenance)
National Behavioral Healthcare Services, the covered entity (CE), reported that one of its workforce members inadvertently emailed a spreadsheet containing protected health information (PHI) to one patient’s parent. The breach (which was initially reported as affecting more than 500) affected 498 individuals (patients and their guardians) and included names, birthdates, contact information, insurance company identification, and other identifying information. The CE provided breach notification to HHS and affected individuals. Following the breach, the CE conducted an investigation, counseled and retrained its workforce members and implemented safeguards, including placing additional restrictions on the use and disclosure of PHI. As a result of OCR’s investigation, the CE reviewed its policies and procedures, and revised its policies for using and safeguarding spreadsheet information. As of November 2017 the CE ceased doing business.