HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of May 20, 2010.
- Organization as reported
- University of Rochester Medical Center and Affiliates, NY
- Entity type as reported
- Healthcare Provider
- Category as reported
Other
- Location of information as reported
- Paper/Films
- Submission date
- May 20, 2010
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 16052, row:7191)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE), University of Rochester Medical Center and Affiliates, reported that on April 19, 2010, 2,628 patient billing statements for Strong Memorial Hospital were sent to the wrong patients. The statements contained patients’ names, addresses, guarantors’ names, guarantors’ addresses, dollar amounts owed, health insurance plans, subscriber numbers, social security numbers, general descriptions of services rendered (such as inpatient room charge, outpatient visit charge, physical therapy, laboratory, pharmacy, radiology, etc.) and dates of service. The CE provided breach notification to HHS, affected individuals, and the media. As a result of the breach, the CE established a numerical counter to ensure that the numbers of statements that run through the folding machine are matching the numbers of statements that are printing. In addition, a report was added to the statement bundles distributed by the printing center that identifies the number of pages printed for each statement run. Further, a quality control process was put into place where a second staff member manually inspects stuffed envelopes on a random basis to ensure that the correct number of pages are inserted as well as verifying that the contents are all for the same patient. As a result of OCR investigation, OCR reviewed a copy of the CE’s risk assessment and policies and procedures relating to uses and disclosures of protected health information (PHI) and safeguarding PHI.