HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of Oct. 2, 2013.
- Organization as reported
- UnityPoint Health Affiliated, IA
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Electronic Medical Record
- Submission date
- Oct. 2, 2013
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15309, row:6448)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE), UnityPoint Health, discovered that an office manager (from an independent private practice) was using physicians’ passwords to access patients’ protected health information (PHI). The types of PHI involved in the breach included names, social security numbers, addresses, driver’s license numbers, dates of birth, diagnoses, lab results, and medications affecting approximately 1,825 individuals. The CE provided breach notification to HHS, affected individuals, and the media, and contacted the proper authorities to investigate any possible criminal infractions. The CE investigated the breach, which resulted in the office manager’s resignation from her job. The CE also retrained the physicians who shared their passwords with the office manager and obtained written assurances they would no longer share passwords. OCR obtained and reviewed the CE’s HIPAA compliance documentation.