HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of Aug. 11, 2017.
- Organization as reported
- Silver Cross Hospital, IL
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Network Server
- Submission date
- Aug. 11, 2017
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14097, row:5236)
- Archived copy
- Held in the private archive (provenance)
Beginning on or around November 30, 2016, Silver Cross Hospital’s business associate (BA), Demi & Cooper Advertising, updated its software. The software upgrade reconfigured security settings such that data in completed web forms was potentially made available on the internet without password protection. This breach affected 8,862 individuals. The types of protected health information involved in the breach included demographic, financial and clinical information. Following the breach, the covered entity (CE) hired a third party forensic investigator and determined that no one had impermissibly accessed the information in the web forms, but the “Bing” search engine cached six pages and indexed four pages. The CE requested that Bing remove the information from its data base and the forensic investigation company confirmed the removal. The CE also implemented additional security safeguards for its web forms and conducted a HIPAA Security risk analysis. CE provided breach notification to HHS, affected individuals, and the media, as well as posting substitute notice, as required by the Breach Notification Rule. OCR obtained assurances that the CE implemented the corrective actions noted here.