HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of June 16, 2017.
- Organization as reported
- Rutland Regional Medical Center, VT
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Submission date
- June 16, 2017
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14163, row:5302)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE), Rutland Regional Medical Center, sent 668 patient surveys via email to recently discharged patients. The recipient’s email address was placed in the “To” line of the emails making each recipient’s email address, which contained names, visible to all other recipients. Of the 668 emails in the address lines, three were duplicates, leaving 665 patient email addresses disclosed. The CE provided breach notification to HHS, affected individuals, and the media. The CE also set up an assistance help line for individuals who might have additional questions. As a result of OCR’s investigation, the CE revised its policies regarding using and disclosing protected health information and sending patient emails. Additionally, the CE re-trained its staff on its HIPAA policies. OCR obtained assurances that the CE implemented the corrective actions noted above.