HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Dec. 2, 2015.
- Organization as reported
- University of Colorado Health, CO
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Electronic Medical Record
- Submission date
- Dec. 2, 2015
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14658, row:5797)
- Archived copy
- Held in the private archive (provenance)
On October 9, 2015, University of Colorado Health, the covered entity (CE) discovered that a nurse working in one of the CE’s network hospitals impermissibly accessed 827 individuals’ medical records between October 2014 and September 2015. The CE discovered the nurse’s impermissible accesses after an anonymous individual telephoned the CE’s privacy hotline regarding the nurse’s suspected conduct. To carry out these impermissible accesses, the nurse utilized the CE’s electronic health record (EHR) application. The CE provided breach notification to HHS, the media, and affected individuals. Based on the breach and OCR’s investigation, the CE sanctioned the nurse and terminated her access to the EHR. The CE also retrained nursing staff regarding use of the EHR in accordance with HIPAA. The CE has reported similar breaches to OCR, and OCR has consolidated the unresolved issues from this breach into a review along with related compliance concerns arising from the CE’s other breaches.