HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of May 6, 2014.
- Organization as reported
- Porter, MD, Steven, UT
- Entity type as reported
- Healthcare Provider
- Category as reported
Improper Disposal
- Location of information as reported
- Network Server
- Submission date
- May 6, 2014
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15088, row:6227)
- Archived copy
- Held in the private archive (provenance)
Steven A. Porter, M.D., a gastroenterologist in Ogden, Utah, has agreed to pay $100,000 to the Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services (HHS) and to adopt a corrective action plan to settle a potential violation of the Health Insurance Portability and Accountability Act (HIPAA) Security Rule. OCR began investigating Dr. Porter’s medical practice (the Practice) after it filed a breach report with OCR in 2013. OCR’s investigation revealed the Practice’s ongoing noncompliance with the Security Rule’s Security Management Process standard, including the Practice’s failure to conduct enterprise-wide risk analyses, and its failure to reduce the risks and vulnerabilities to a reasonable and appropriate level. OCR also determined that the Practice lacked sufficient HIPAA policies and procedures. Despite OCR’s provision of technical assistance regarding the Practice’s risk analysis and risk management efforts, the Practice failed to conduct Security Rule compliant risk analyses and risk management plans. In addition to the monetary settlement, the Practice will undertake a corrective action plan that includes two years of monitoring.