HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Nov. 30, 2018.
- Organization as reported
- Thielen Student Health Center, IA
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Submission date
- Nov. 30, 2018
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13613, row:4752)
- Archived copy
- Held in the private archive (provenance)
Thielen Student Health Center, the covered entity (CE), sent patient survey invitation emails to the wrong patients on November 5, 2018, due to a human coding error. Initially, the CE reported that 599 individuals were affected by the breach; however, the information in 594 of the erroneously addressed emails implicated the Family Educational Rights and Privacy Act (FERPA), rather than HIPAA. Additionally, the CE was able to successfully recall one of the five emails containing electronic protected health information (ePHI); therefore, only ePHI belonging to four individuals was breached under HIPAA. The breached ePHI included patients' names, appointment dates, and physician's names. The CE provided breach notification to the affected individuals, the media, and HHS. The CE revised its patient survey emails to no longer contain ePHI, retrained the employee responsible for the breach, and provided OCR with written assurances that it would revise and implement Privacy Rule policies and procedures.