HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Aug. 19, 2016.
- Organization as reported
- Orleans Medical Clinic, IN
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Network Server
- Submission date
- Aug. 19, 2016
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14448, row:5587)
- Archived copy
- Held in the private archive (provenance)
Hackers gained access to the covered entity’s (CE) unsecured computer server from April 5, 2016, through April 17, 2016, after its business associate (BA), ProBleu, upgraded its servers and left a port open to the internet. The server contained the protected health information (PHI) of approximately 6,890 individuals, including demographic and clinical information. The CE, Orleans Medical Clinic (OMC), provided breach notification to HHS, affected individuals, and the media on August 19, 2016, and also reported the breach to the Indiana Attorney General’s office and the FBI. To prevent similar breaches from happening in the future, OMC retained Pondurance, a forensic information technology firm. Pondurance concluded that the BA failed to take the necessary steps to secure the CE’s server by implementing the required technical safeguards. The CE terminated its relationship with the BA in July of 2016, created a policy and procedure regarding the Breach Notification requirements, and trained its workforce on its security awareness policies and procedures. OCR provided technical assistance and obtained documented assurances that the CE implemented the corrective actions listed above.