HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of Jan. 30, 2015.
- Organization as reported
- UMass Memorial Medical Group, Inc., MA
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Paper/Films
- Submission date
- Jan. 30, 2015
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14889, row:6028)
- Archived copy
- Held in the private archive (provenance)
UMass Memorial Medical Group, Inc., the covered entity (CE), reported that an employee impermissibly accessed the protected health information (PHI) of its patients for approximately four months in 2014. The breach report to OCR, the individuals and the media was delayed at the request of law enforcement officials. Once law enforcement officials indicated that notifications would not compromise their investigation, the CE provided the required notifications. The breach affected approximately 14,000 individuals. The employee was sanctioned and then resigned from the CE. OCR’s investigation revealed that the employee had permissible access to the PHI to perform her job duties, but that she also used that access for a purpose not permitted by the Rules. As a result of OCR’s investigation, the CE implemented new technical safeguards to more closely monitor employee access to PHI and restrict available information in patient records; established new physical safeguards; created a new training program for all staff; engaged a third-party consultant to review its privacy and security programs; and provided free credit monitoring and a call-center for affected individuals. OCR obtained assurances that the CE implemented the corrective actions listed.