HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of May 18, 2018.
- Organization as reported
- UT Physicians, TX
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Submission date
- May 18, 2018
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13812, row:4951)
- Archived copy
- Held in the private archive (provenance)
On May 7, 2018, University of Texas Physicians, the covered entity (CE), discovered one of its workforce members sent an email disclosing the protected health information (PHI of 2,793 patients to other patients listed on the email. The workforce member inserted multiple patient email addresses into the “to” field rather than the “blind carbon copy” or “bcc” field, which allowed the patients to see each other’s email addresses. In response to the incident, the CE implemented technical safeguards to prevent similar situations and retrained its workforce members on the proper use of email when communicating with patients. Following the incident, the CE also provided evidence it notified affected individuals and the media. OCR obtained assurances that the CE implemented the corrective actions listed.