HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Sept. 28, 2016.
- Organization as reported
- Thomasville Eye Center, GA
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Desktop Computer
- Submission date
- Sept. 28, 2016
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14409, row:5548)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE), Thomasville Eye Center, discovered that one of its employees opened a credit account for a patient without authorization. The employee was able to access patient names, addresses, dates of birth, Social Security numbers, and billing information. Although the CE only knows of one patient being impacted, the employee accessed records of 11,137 individuals during her employment, all of whom may have been affected. The CE provided breach notification to HHS, the individuals who may have been affected, the media, and on its website. Following the breach, the CE retrained employees and revised policies and procedures to limit employee access to protected information. OCR obtained assurances that the CE implemented the corrective actions listed above. The CE also terminated the employee involved, notified local law enforcement, and the FBI.