HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Nov. 27, 2017.
- Organization as reported
- Pulmonary Specialists of Louisville, PSC, KY
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Electronic Medical Record
- Submission date
- Nov. 27, 2017
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13994, row:5133)
- Archived copy
- Held in the private archive (provenance)
On September 26, 2017, Pulmonary Specialists of Louisville, PSC, the covered entity (CE), discovered that an unauthorized third party had impermissibly accessed its electronic health record (EHR) system, affecting 32,000 individuals. The EHR system contained protected health information (PHI), including names, addresses, telephone numbers, dates of birth, Social Security numbers, health insurance information, and health diagnoses and conditions. In response to the breach, the CE disabled the open computer port that was the source of the foreign connection, rebuilt its file system, transferred to a cloud-based fully encrypted EHR system and ultimately migrated to a cloud-based server. As a result of OCR’s investigation, the CE created and/or revised its policies on information systems activity review, access controls, user authentication, unique user ID, and contingency plans. OCR provided the CE with technical assistance on the Breach Notification Rule and workforce training requirements and documentation. The CE provided breach notification to HHS, affected individuals, and the media. OCR obtained assurances that the CE implemented the corrective actions listed above.