HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Sept. 30, 2016.
- Organization as reported
- University of Wisconsin Hospitals and Clinics Authority, WI
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Paper/Films
- Submission date
- Sept. 30, 2016
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14405, row:5544)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE), University of Wisconsin and Clinics Authority, reported that a survey was erroneously mailed to family members of 6,923 patients rather than to the patients directly. The breach occurred because of formatting problems sent in a data file to the CE’s business associate (BA). The PHI included patients’ names and the names of patients’ healthcare providers. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE initiated an internal investigation and directed appropriate staff and the BA (collectively, the “Root Cause Analysis Team”) to determine the root cause and severity of the breach. As a result of the root cause analysis, the CE developed an action plan to prevent similar disclosures, revised and redesigned processes for providing patient survey information, and trained pertinent staff on the new processes. OCR obtained documented assurances that the CE implemented these corrective actions. During the investigation, OCR reviewed copies of the CE’s policies and procedures for uses and disclosures and the safeguarding of PHI.