HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of July 5, 2017.
- Organization as reported
- The Dermatology Center of Raleigh PA, NC
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Submission date
- July 5, 2017
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14137, row:5276)
- Archived copy
- Held in the private archive (provenance)
On June 21, 2017, the covered entity (CE), The Dermatology Center of Raleigh, PA, discovered that its employee sent a patient list to a Sona Dermatology & Med Spa (“Sona”) employee in an unsecure/unencrypted email format. The patient list contained the names, account numbers, and telephone numbers of 3,000 individuals. The CE provided breach notification to HHS, affected individuals and the media. Following the breach, the CE and Sona formally entered into a management services agreement and Sona improved safeguards by implementing encryption solutions and strengthened its access policy and procedures to enable only authorized users to access the minimum necessary information needed to perform job functions. The CE invested in equipment, applications and software to detect human errors and malware, duplication of data, and to prevent improper data integration. OCR provided technical assistance regarding the definition of a breach, the low probability of compromise factors, and the Breach Notification Rule. OCR obtained assurances that the CE met its notification requirements and implemented the corrective actions listed above.