HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of June 10, 2016.
- Organization as reported
- Saints Mary and Elizabeth Hospital, KY
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Submission date
- June 10, 2016
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14502, row:5641)
- Archived copy
- Held in the private archive (provenance)
An employee of the covered entity (CE), Saints Mary and Elizabeth Hospital, sent an email reminder to potential participants of the hospital’s bariatric patient support group and inadvertently attached a spreadsheet of patients’ names associated with bariatric-related surgery. The spreadsheet contained the names, surgery dates, addresses, emails, and phone numbers of 1,682 individuals. The CE unsuccessfully tried to recall the message. The CE’s internal investigation determined that the involved employee failed to utilize the auto-encryption feature for email containing protected health information (PHI). The CE provided breach notification to HHS, affected individuals, and the media and posted substitute notices on its website. Following the breach, the CE retrained its employees on email policies and procedures and best practices for securing PHI sent through email. The CE sanctioned the involved employee and ceased using email to send reminders about support group activities. OCR obtained assurances that the CE implemented the corrective actions listed above.