HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Feb. 9, 2015.
- Organization as reported
- Tomas, Arturo, IL
- Entity type as reported
- Business Associate
- Category as reported
Loss
- Location of information as reported
- Paper/Films
- Submission date
- Feb. 9, 2015
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14884, row:6023)
- Archived copy
- Held in the private archive (provenance)
On February 2, 2014, Artuo D. Tomas, MD LTD's office, the covered entity (CE), discovered that a package containing the protected health information (PHI) of approximately 680 individuals had been lost in the process of shipment to its billing company through the U.S. Postal Service (USPS). The PHI included individuals’ names, addresses, phone numbers, dates of birth, referring physician names, medical record numbers, diagnoses, and clinical information. The CE provided notification of the breach to the affected individuals, HHS, and the media. The CE also filed a claim with the USPS regarding the missing package. Following the breach, the CE implemented a new procedure for sending PHI to the billing company that requires PHI to be transmitted either electronically through a secure and encrypted portal or through a third-party mail service with tracking capabilities. Additionally, the CE developed policies and procedures regarding compliance with the Breach Notification Rule. OCR obtained assurances that the CE implemented the corrective actions listed.