HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of July 15, 2016.
- Organization as reported
- Providence Medical Group- Gateway Clinics, OR
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Electronic Medical Record
- Submission date
- July 15, 2016
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14478, row:5617)
- Archived copy
- Held in the private archive (provenance)
In July 2016, the covered entity (CE), Providence Medical Group – Gateway Clinics, reported that its privacy monitoring program discovered inappropriate access to medical records by one its financial coders. The audit revealed that the employee had impermissibly accessed the medical records of 5,977 individuals. The types of protected health information (PHI) involved in the breach varied by patient, but could have included demographic and medical treatment information, and may have included images of driver's licenses, insurance data and Social Security numbers. The CE provided breach notification to HHS, affected individuals, and the media and also offered individuals two years of credit monitoring. Following the breach, the CE sanctioned the employee and disabled electronic and physical access to its systems. The CE also retrained coders on its privacy policies and reviewed its risk assessment and risk management plan. OCR obtained assurances that the CE implemented the corrective actions listed above.