HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Sept. 30, 2016.
- Organization as reported
- Urgent Care Clinic of Oxford, MS
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Network Server
- Submission date
- Sept. 30, 2016
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14406, row:5545)
- Archived copy
- Held in the private archive (provenance)
On August 2, 2016, the covered entity (CE), Urgent Care Clinic of Oxford, discovered that its server was hacked by an unauthorized third party. The CE investigated and determined that the hackers gained access to the server through an administrative account set up by the CE’s technology contractor. The types of protected health information (PHI) involved in the breach included patient names, addresses, dates of birth, driver’s licenses, social security numbers, claims information, diagnoses and conditions, lab results, and medications, affecting approximately 64,000 individuals. The CE provided breach notification to HHS, affected individuals, and the media. In response to the breach, the CE immediately shut down its server’s remote access, contacted law enforcement, hired forensic investigators and installed a new network sonic wall to protect its entire system. OCR provided technical assistance to the CE regarding risk analysis and risk management. Consequently, the CE altered its policies and procedures to include full monthly testing of its server and a new risk assessment in accordance with OCR’s Security Risk Assessment Tool. Moreover, the CE retrained its workforce on its updated policies and procedures. OCR obtained assurances that the CE implemented the corrective actions listed above.