HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of March 20, 2017.
- Organization as reported
- UNC Health Care, NC
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Paper/Films
- Submission date
- March 20, 2017
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14236, row:5375)
- Archived copy
- Held in the private archive (provenance)
On January 26, 2017, UNC Health Care, the covered entity (CE), learned from a patient that between April 1, 2014, and February 17, 2017, the CE’s clinics had all prenatal patients complete a pregnancy home risk screening form to see if they were eligible for additional support services from Medicaid and sent all the forms to local county health departments, including for patients not participating in Medicaid. The breach affected the protected health information (PHI) of 1,298 individuals and included names, addresses, race, ethnicity, social security numbers, social behaviors, mental health statuses, sexually transmitted diseases, HIV status, drug and alcohol use, and medical diagnosis information related to pregnancy. The CE provided breach notification to HHS, affected individuals, and the media and posted substitute notice and offered identity theft resolution services. The CE instructed the clinics to stop having non-Medicaid beneficiaries complete the screening forms, and the clinics purged their files of any non-Medicaid forms they had received. The CE retrained staff on the new procedure. OCR obtained assurances that the CE implemented the corrective actions listed above.