HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Nov. 30, 2018.
- Organization as reported
- Prairie Fields Family Medicine, PC, NE
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Submission date
- Nov. 30, 2018
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13614, row:4753)
- Archived copy
- Held in the private archive (provenance)
On October 1, 2018, Prairie Fields Family Medicine, P.C., the covered entity (CE), discovered that an employee inadvertently emailed an unencrypted Excel spreadsheet, containing 6,450 individuals’ protected health information (PHI), to an unintended recipient. The types of PHI involved in the breach included demographic information, primary health insurers' names, and insurance policy numbers. At the time of the breach, the CE had implemented policies and procedures restricting its employee from sending PHI via unencrypted email. The CE provided breach notification to affected individuals, the media, and HHS. The CE also sanctioned the responsible employee and retrained all staff. Finally, the CE implemented an email encryption application for future email correspondence containing PHI. OCR verified that the CE revised its HIPAA policies and procedures that restrict impermissible uses and disclosures of PHI and require employees to safeguard PHI.