HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Dec. 27, 2012.
- Organization as reported
- Sovereign Medical Group, LLC, NJ
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident, Theft
- Location of information as reported
- Network Server
- Submission date
- Dec. 27, 2012
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15503, row:6642)
- Archived copy
- Held in the private archive (provenance)
OCR opened an investigation of the covered entity (CE), Sovereign Medical Group, LLC, after it reported that its data files were corrupted and were inaccessible on its network server. The CE received a ransom note from a hacker advising that if it paid the specified amount the CE could regain access to its files. The breach affected 27,800 individuals and the types of electronic protected health information (ePHI) included demographic information, social security numbers, driver’s license numbers, insurance information, dates of services, claims information, diagnoses, and procedure codes. Upon discovering the breach, the CE filed reports with the police department, the county prosecutor’s office, and the Federal Bureau of Investigations. The CE provided breach notification to HHS, affected individuals, and the media, and offered one year of free credit monitoring services to the affected individuals. As a result of the breach, the CE closed inbound communication ports to the contaminated server, deployed a web-filtering mechanism to scan and monitor all outbound traffic, and disabled all wireless networks. OCR provided the CE with technical assistance regarding the HIPAA Security Rule.