HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Jan. 10, 2017.
- Organization as reported
- SSM Dean Medical Group, WI
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Submission date
- Jan. 10, 2017
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14304, row:5443)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE), SSM Health, inadvertently sent email addressed to the wrong recipient patients due to an improperly sorted data file. The protected health information (PHI) involved in the breach included the full names of approximately 4,800 individuals. Following the breach, the CE attempted to provide breach notification to the affected individuals and provided media notification. During the course of its investigation, OCR discovered that the CE's notice to the affected individuals was not sent in accordance with the Breach Notification Rule because it sent electronic notice to without a prior agreement from the individuals to receive notice electronically. As a corrective action, the CE agreed to provide written notice to the affected individuals via first-class mail, in accordance with the Rule, and then provided OCR proof of such written notice. To prevent a similar breach from happening in the future, the CE instituted a procedural checklist to be followed for all mass email communications.