HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Sept. 11, 2015.
- Organization as reported
- Sutter Medical Foundation, CA
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Submission date
- Sept. 11, 2015
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14713, row:5852)
- Archived copy
- Held in the private archive (provenance)
Sutter Medical Foundation (SMF), the covered entity (CE), reported that Sutter Health discovered that a former employee of Sutter Connect, LLC, dba Sutter Physician Services (SPS) had retained copies of certain SPS information containing patient information. Sutter Health was alerted to this situation by the former employee’s relatives, who expressed concern that the former employee may have been involved in separate identity theft and/or unlawful check writing efforts. As a part of its investigation into the matter, Sutter Health determined that the former employee had separately emailed certain electronic documents to a personal email account. The emails included information on 2,302 individuals. The types of protected health information (PHI) involved included names, dates of birth, financial information, claims information, clinical information, and diagnosis/conditions. As a result of OCR’s investigation, SMF filed a separate breach report for the initial incident involving the retention of copies of paper records. Additionally, SMF re-trained its staff on how to safeguard PHI.