- State
- IA
- Covered entity type
- Healthcare Provider
- Individuals affected
- 5,292
- Business associate present
- No
- Type of breach
- Unauthorized Access/Disclosure
- Location of breached information
- Other
- First seen by InfoSec Signals
- 9/23/2026
- Last seen in OCR export
- 9/23/2026
OCR description
A student employee used an online open source programming tool, GitHub, to program a data transfer, but failed to label his programming as private. This exposed the protected health information of 5,292 individuals online for more than a year until the covered entity (CE) discovered it on April 29, 2017. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE updated its Security Rule Risk Management Plan, implemented periodic technical and nontechnical evaluations, and retrained its workforce members. OCR obtained documented assurances that the CE implemented the corrective actions listed.
Change history
- 9/23/2026Added to OCR's archive list
Source: HHS OCR Breach Portal, U.S. Department of Health and Human Services, Office for Civil Rights about this source
Records are reproduced as published; entity names and figures are OCR's.