HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of March 27, 2014.
- Organization as reported
- Susquehanna Health, PA
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Submission date
- March 27, 2014
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15135, row:6274)
- Archived copy
- Held in the private archive (provenance)
In response to an insurer’s routine claims request, an employee provided more protected health information (PHI) than was necessary to complete the intended purpose. Approximately 657 patients were affected. The impermissible disclosure included patients’ names, addresses, social security numbers, dates of birth, health insurance information, payment information, encounter identification, physicians’ names, diagnosis codes, and patients’ employers. The covered entity (CE), Susquehanna Health, provided breach notification to HHS and affected individuals. The CE also offered one year of free identity theft protection and credit monitoring to affected individuals. Following the breach, the CE immediately ensured that all recipients of the PHI deleted the data from their computers and shredded all hard copies. OCR obtained and reviewed copies of the CE’s policies and procedures related to the issues raised in this complaint, as well as a copy of its current risk assessment. As a result of OCR’s investigation, the CE sanctioned the staff member, retrained the entire department, and revised its email policies.