HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of June 9, 2015.
- Organization as reported
- Truman Medical Center, Incorporated, MO
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Other
- Submission date
- June 9, 2015
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14780, row:5919)
- Archived copy
- Held in the private archive (provenance)
An employee of the covered entity (CE), Truman Medical Center, found a list of patients on the internet. The list contained names, addresses, and internal identification numbers for 503 of the CE's patients. The CE determined that the list was posted to a file transfer protocol (FTP) site by the public relations department and was a mailing list used to notify patients that a clinic was moving to a new location. The list was available on the internet from September 2012 until March 2015. The CE provided breach notification to HHS, affected individuals and the media, and provided substitute notice on its website. Following the breach, the CE immediately removed and deleted the patient list from FTP site and reviewed the other information posted on the site. The CE improved safeguards by enabling the public relations employees to send encrypted emails and providing instructions on how to use secure email. The CE also required additional training for workforce members in the public relations department. OCR obtained written assurances that the CE implemented the corrective actions listed above.