HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of May 21, 2019.
- Organization as reported
- Penn Medicine, PA
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Electronic Medical Record
- Submission date
- May 21, 2019
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13398, row:4537)
- Archived copy
- Held in the private archive (provenance)
An employee of a staffing agency who was placed at the covered entity (CE) was arrested for fraud and the CE subsequently determined that she impermissibly accessed and used at least one patient’s protected health information (PHI) and potentially affected the PHI of 917 individuals. The types of PHI involved in the incident included names, dates of birth, social security numbers, and clinical information. The CE provided breach notification to HHS and all potentially affected individuals, including patients whose records were likely accessed by the employee to complete her job duties. Following the breach, the CE required its staffing agencies to conduct more vigorous background checks for employees placed at the CE. OCR reviewed the CE’s response to this incident which included the business associate agreement.