HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of Sept. 28, 2011.
- Organization as reported
- Summit Medical Group, PLLC, TN
- Entity type as reported
- Healthcare Provider
- Category as reported
Theft
- Location of information as reported
- Paper/Films
- Submission date
- Sept. 28, 2011
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15770, row:6909)
- Archived copy
- Held in the private archive (provenance)
On September 4, 2011, a Summit Medical Group (SMG) employee’s car was burglarized, resulting in the theft of paper reports containing the protected health information (PHI) of approximately 731 of the covered entity’s (CE) patients. The PHI involved in the breach included account numbers, patients’ names, physicians’ names, names of hospitals, dates of discharge, dates of birth, names of insurance providers, and discharge diagnoses. The CE provided breach notification to HHS, the media, and affected individuals. It also offered credit monitoring services and created a customer service center to handle questions. Following the breach, the CE initiated an internal investigation, filed a police report, notified the affected physician sites of the breach, conducted a risk assessment, and adopted additional identification verification measures for affected individuals. As a result of OCR’s investigation, the CE updated its HIPAA policies and procedures and improved safeguards by encrypting laptop computers.