HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of Oct. 24, 2017.
- Organization as reported
- TJ Samson Community Hospital, KY
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Electronic Medical Record
- Submission date
- Oct. 24, 2017
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14020, row:5159)
- Archived copy
- Held in the private archive (provenance)
On August 25, 2017, the covered entity (CE), T.J. Samson Community Health, discovered that two employees from its affiliate, Anesthesiology Associates of Glasgow, PSC (“AAG”), impermissibly accessed protected health information (PHI) outside a legitimate job-related reason. The breach affected approximately 683 individuals and included names, dates of birth, Social Security numbers, diagnoses, medications, lab results, and insurance plan information. The CE provided breach notification to HHS, affected individuals, and the media. In response to the breach, the CE terminated the access credentials for both involved employees and they were sanctioned. Additionally, the CE revised and created new policies such as its Confidentiality Agreement Policy which requires any affiliated physician practice requesting access to PHI to enter into an access agreement providing assurances of confidentiality, compliance with HIPAA, and annual attestations. Furthermore, the CE reeducated its own staff as well AAG’s on employee access to PHI and HIPAA best practices. OCR obtained assurances that the CE implemented the corrective actions listed above. The involved employees no longer work for AAG.