HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of June 24, 2014.
- Organization as reported
- Sloane Stecker Physical Therapy, PC, NY
- Entity type as reported
- Healthcare Provider
- Category as reported
Theft
- Location of information as reported
- Electronic Medical Record
- Submission date
- June 24, 2014
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15056, row:6195)
- Archived copy
- Held in the private archive (provenance)
A workforce member, a physical therapist, accessed the electronic health record system and obtained 2,000 patients’ names, addresses and telephone numbers for the purpose of contacting or soliciting these patients to join a new physical therapy practice. The covered entity (CE), Sloane Stecker Physical Therapy, PC, provided breach notification to HHS, affected individuals, and the media and posted substitute notice on its website. The also CE provided free credit monitoring for the affected individuals. Following the breach, the CE retrieved the patient information and retrained staff. As a result of OCR’s investigation and technical assistance, the CE is expected to perform an enterprise-wide risk analysis and establish a risk management plan. It is also expected to implement mechanisms to record and examine activity in information systems that contain or use electronic PHI. Additionally, the CE is expected to implement a security incident policy and procedure, implement procedures for identity verification for access to electronic PHI, and provide training to all staff on the newly implemented policies and procedures.