HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Jan. 7, 2014.
- Organization as reported
- Phoebe Putney Memorial Hospital, GA
- Entity type as reported
- Healthcare Provider
- Category as reported
Theft
- Location of information as reported
- Electronic Medical Record, Paper/Films
- Submission date
- Jan. 7, 2014
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15213, row:6352)
- Archived copy
- Held in the private archive (provenance)
On April 9, 2012, Phoebe Putney Memorial Hospital, Inc., the covered entity (CE), learned from law enforcement that an employee of Phoebe Home Care (PHC), a department of the CE, improperly accessed patients' protected health information (PHI) with the intent to process fraudulent tax returns. An internal investigation and audit concluded that the employee accessed the medical records in a combination of paper and electronic form. The PHI affected 2,354 individuals and contained patients’ names, dates of birth and social security numbers. In response to the breach, the CE sanctioned the responsible employee. The CE provided breach notification to HHS, affected individuals, and the media and also posted substitute notice on its website. The CE improved safeguards by locking cabinets containing patient files, creating a security access hierarchy to assure role-based access to PHI, and encrypting laptop computers. Additionally, the CE removed social security numbers from its referral form and removed employee social security numbers from its software system. The CE implemented monthly audits on its electronic medical records system and established an annual HIPAA in-service training program for management and staff. OCR obtained assurances that the CE implemented the corrective actions listed above.