HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of March 17, 2014.
- Organization as reported
- TMA Practice Management Group, TX
- Entity type as reported
- Business Associate
- Category as reported
Improper Disposal, Loss
- Location of information as reported
- Other Portable Electronic Device
- Submission date
- March 17, 2014
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15148, row:6287)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE), McBroom Clinic, PA, signed a business associate (BA) agreement with TMA Practice Management Group to provide an operational assessment/audit. As part of the assessment the BA requested, and the CE provided, certain health information about patients. The protected health information (PHI) included clinical and insurance/payment information about patients. The CE copied some of the PHI to an unencrypted portable USB flash drive and sent it to the BA with other information in a package on January 7, 2014. Upon receipt of the empty package, the BA subsequently discarded it in the recycling receptacle. On or around February 21, 2014, the Clinic contracted with AllClear ID to assist with the patient notification and mitigation efforts. As a result of the breach, the CE instituted new procedures for extracting and sending PHI via portable media, including encryption. Due to OCR’s investigation, the CE was made aware of the following areas of improvement: risk analysis and staff training on policies and procedures.