HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Oct. 21, 2017.
- Organization as reported
- Recovery Institute of the South East P.A., FL
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Desktop Computer, Electronic Medical Record, Email, Laptop, Network Server, Other, Other Portable Electronic Device, Paper/Films
- Submission date
- Oct. 21, 2017
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14023, row:5162)
- Archived copy
- Held in the private archive (provenance)
On October 21, 2017, the Recovery Institute of the South East, P.A., the covered entity (CE), reported that a former employee remotely accessed its computers without authorization between December 2016 and October 2017. The CE reported that 689 individuals were affected; however, a subsequent forensic investigation by Envista Forensics found no evidence of malware, unauthorized access, or unauthorized data exfiltration. Based on these findings, the CE concluded that protected health information (PHI) was not exposed and no patients were affected. During this review, OCR found that although there was no breach, the CE did not have adequate policies or procedures in place to safeguard PHI. OCR provided technical assistance to the CE, and in response, the CE adopted and implemented a comprehensive set of policies and procedures to comply with HIPAA requirements. OCR also conducted outreach with the CE and has obtained assurances that the CE implemented the voluntary corrective actions noted above.