HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of Aug. 31, 2018.
- Organization as reported
- United Methodist Homes, NY
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Submission date
- Aug. 31, 2018
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13706, row:4845)
- Archived copy
- Held in the private archive (provenance)
A workforce member of the covered entity (CE), United Methodist Homes, sent an email to his personal email account with a spreadsheet attachment that contained 843 residents’ protected health information (PHI). The spreadsheet included residents’ names, internal medical record numbers, as well as the names, addresses and phone numbers (and in some cases, email addresses) for each resident’s contact person(s) on file, and the contact person’s relationship with the resident. The CE provided breach notification to HHS, the media, and the affected individuals (including the offer of 12 months of credit monitoring services), and posted notice to its website. Following the breach, the CE sanctioned the responsible workforce member, implemented an email application that filters and quarantines any outgoing emails that contain ePHI, and enhanced Transport Layer Security (TLS) functionality to automatically encrypt such outgoing emails. OCR obtained assurances that the CE implemented the corrective actions listed. Additionally, the CE is expected to conduct a risk analysis, implement a corresponding remediation plan, and take certain actions to formalize its information system activity review activities.