HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Nov. 18, 2016.
- Organization as reported
- Peachtree Orthopaedic Clinic, GA
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Network Server
- Submission date
- Nov. 18, 2016
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14361, row:5500)
- Archived copy
- Held in the private archive (provenance)
Peachtree Orthopaedic Clinic, the covered entity, discovered that there had been an unauthorized intrusion into its computer system. It determined that the intruder may have been able to access the protected health information (PHI) of approximately 531,000 patients. The PHI included names, addresses, dates of birth, Social Security Numbers, and some clinical information. The covered entity retained a third party IT security firm to perform a forensic evaluation. It ended its relationship with the business associate that it concluded was the source of the compromise to its database. The covered entity also implemented several additional technical safeguards, including: a new intrusion detection system, improved its firewall, reset all of its user passwords, upgraded its anti-virus software, including additional monitoring of user activity, and implemented multi-factor authentication for remote users. As a result of OCR’s investigation, Peachtree Orthopaedic Clinic also completed a new risk analysis. It provided breach notification to HHS, the affected individuals, the media, and on its website. OCR obtained assurances that the covered entity implemented the corrective actions outlined above.