Breach notice filed by Silver Creek Fitness & Physical Therapy, Silver Creek Physical Therapy Gilroy, Silver Creek Physical Therapy Sunnyvale, Silver Creek Physical Therapy (October 2016)

HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice

Posted on the HHS Office for Civil Rights breach portal with a submission date of Oct. 24, 2016.

Organization as reported

Silver Creek Fitness & Physical Therapy, Silver Creek Physical Therapy Gilroy, Silver Creek Physical Therapy Sunnyvale, Silver Creek Physical Therapy, CA

Entity type as reported

Healthcare Provider

Category as reported

Unauthorized Access/Disclosure

Location of information as reported

Network Server

Submission date

Oct. 24, 2016

Observed by BreachRecords

2026-10-18 16:15 UTC (revision 14382, row:5521)

Archived copy

Held in the private archive (provenance)

An electronic data storage account belonging to a business associate (BA), Rehab Billing Solutions, was accessible to persons outside its organization from May, 2016 to September 11, 2016. A third party security researcher from a software company accessed and downloaded protected health information (PHI) about the covered entity’s (CE) patients from this account. The types of PHI potentially involved in the breach included names, Medicare numbers, dates of birth, social security numbers, driver’s license numbers, prescriptions, treatment locations, treatment dates, and progress notes. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the BA took steps to secure the storage account and launched an investigation . The CE worked with the BA to confirm that the security researcher deleted all of the downloaded information. The CE offered one year of free credit monitoring and identity restoration services to all affected individuals. OCR reviewed the BA agreement between the CE and the BA and obtained assurances that the CE and BA implemented the corrective actions noted above.