HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of May 31, 2018.
- Organization as reported
- The University of Texas MD Anderson Cancer Center, TX
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Submission date
- May 31, 2018
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13800, row:4939)
- Archived copy
- Held in the private archive (provenance)
On May 3, 2018, the covered entity (CE), the University of Texas MD Anderson Cancer Center, discovered that a workforce member erroneously sent a research recruitment email to 1,266 individuals in a manner that allowed them to be seen by the other email recipients. The CE determined that some emails were undeliverable and it stopped others; however, it is believed 599 emails were delivered. The CE provided breach notification to HHS, affected individuals, and the media. In response to the breach incident, the CE implemented a new technical safeguard and re-educated workforce members concerning policies, procedures, and tips to prevent impermissible disclosures of PHI involving email. The CE also sanctioned the involved workforce member. OCR obtained assurances that the CE implemented the corrective actions listed above.