HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Sept. 7, 2012.
- Organization as reported
- University of Miami, FL
- Entity type as reported
- Healthcare Provider
- Category as reported
Other, Unauthorized Access/Disclosure
- Location of information as reported
- Paper/Films
- Submission date
- Sept. 7, 2012
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15572, row:6711)
- Archived copy
- Held in the private archive (provenance)
Two employees of the covered entity (CE), University of Miami Hospital, printed patients’ face sheets in excess of their job duties and sold them over a period of 19 months before the activity was discovered by police while on an unrelated house raid. Following notification by the police, the CE conducted an internal investigation and determined that the breach potentially involved the protected health information (PHI) of 64,846 individuals. The PHI involved in the breach included demographic and clinical information. The CE provided breach notification to HHS, affected individuals, and the media. It also applied sanctions to the involved employees. Following the breach, the CE disseminated educational material to the workforce and reviewed its HIPAA policies and procedures. It also deployed a program which monitors its electronic systems to safeguard against inappropriate use. OCR obtained assurance that the CE took the corrective actions listed above. The CE also confirmed its plan to continue to perform frequent access reviews, periodic audit trail reviews, and to create and retain audit logs for routine analysis.