HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Oct. 12, 2017.
- Organization as reported
- Orthopedics NY, LLP, NY
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Other
- Submission date
- Oct. 12, 2017
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14034, row:5173)
- Archived copy
- Held in the private archive (provenance)
A workforce member created post card invitations for a golf tournament containing the patients’ names, addresses and that they had a total joint replacement. The covered entity (CE) sent the post card invitations to its printing vendor, which printed and mailed the invitations to 2,493 of the CE’s patients. The CE provided breach notification to HHS, the media and affected individuals. Following the breach, the CE re-trained the staff member responsible for creating the invitations regarding the Privacy Rule, implemented a process for the Compliance Officer to review all marketing mailing before distribution and entered into a business associate (BA) agreement with its printing vendor. OCR obtained assurances that the CE implemented the corrective actions listed. The CE is expected to review its practices to ensure compliance with the Breach Notification Rule’s Notice to Individuals requirements, to review its policies to ensure that it appropriately limits the PHI disclosed to the amount reasonably necessary to achieve the purpose of the disclosure, and to revise its HIPAA policy to ensure that the correct contact information is listed for each identified designated official to which workforce members may report any issues related to HIPAA.