HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of June 21, 2016.
- Organization as reported
- Uncommon Care, P.A., NC
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Network Server
- Submission date
- June 21, 2016
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14494, row:5633)
- Archived copy
- Held in the private archive (provenance)
Uncommon Care, P.A., the covered entity (CE), discovered that its business associate (BA), Bizmatics, Inc., was the victim of a computer hacking incident. The incident resulted in potential unauthorized access to the CE’s electronic medical records stored on Bizmatics’ servers. The breach affected 13,674 individuals and included patients' addresses, dates of birth, names, social security numbers, diagnoses, test results, medications, and other treatment information. The CE sent timely breach notification to HHS, to affected individuals, and to the media. The CE also posted notification about the breach on its website. In response to the breach, the CE offered one year of free credit monitoring to the affected individuals. Prior to OCR's investigation, the CE determined that its BA agreement with the BA was not fully executed and entered into an effective BA agreement on June 7, 2016. The CE decided to continue its services contract with the BA and obtained assurances from the BA that improvements have been and will be made to its computer network, servers, and network monitoring activities. OCR obtained assurances that the CE implemented the corrective actions listed above.