HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Aug. 22, 2014.
- Organization as reported
- Oklahoma City Indian Clinic, OK
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Submission date
- Aug. 22, 2014
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15006, row:6145)
- Archived copy
- Held in the private archive (provenance)
A staff member of the covered entity (CE), Oklahoma City Indian Clinic, sent an email to 412 recipients that erroneously included an attachment that contained the electronic protected health information (ePHI) of 6,044 individuals. Following an attempted recall of the message, a corrected email without the attachment was sent, asking the recipients to delete the erroneous email and the attachment. The ePHI involved in the breach included patients’ names, chart numbers, and email addresses. The CE provided breach notification to HHS, affected individuals, and the media, and provided substitute notice. Following the breach, the CE re-trained staff on its encryption policy. In addition, the CE improved safeguards by developing a policy regarding electronic transmission of patient information. The policy limits identifying patient information contained in electronic communications within the CE’s network, and requires password protection for electronic files including ePHI. As a result of OCR’s investigation, OCR obtained assurances that the corrective actions listed above were completed.