HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of June 25, 2019.
- Organization as reported
- University of Iowa Hospitals & Clinics, IA
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Submission date
- June 25, 2019
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13355, row:4494)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE), the University of Iowa Hospitals and Clinics, reported that an employee emailed the protected health information (PHI) of 950 individuals to other members of a research study without authorization. The PHI involved included names, email addresses, and diagnoses/conditions. The CE notified HHS, affected individuals, the media, and established a toll free number for questions or concerns. In its mitigation efforts, the CE implemented additional administrative safeguards and retrained its staff on privacy protections. OCR obtained assurances that the CE implemented the corrective actions noted.