On October 31, 2017, the covered entity (CE), High Plains Surgical Associates, discovered that its former business associate (BA) mistakenly mailed its medical billing records to other health care providers in the same geographical area. Additionally, the former BA sent other providers’ medical billing records to the CE. The breach reportedly affected over 500 individuals, and the protected health information (PHI) impermissibly disclosed included names, addresses, social security numbers, and clinical information. The CE provided breach notification to affected individuals, the media, and HHS. OCR verified that the CE had compliant BA agreements in place that restrict the BA’s use and disclosure of PHI and require the BA to safeguard all PHI. OCR provided technical assistance regarding reasonable safeguards, disclosures to BAs, BA agreements, reportable breach risk assessments, and its additional obligations under the Breach Notification Rule.
Change history
Change history
Sep 23, 2026
Added to OCR's archive list
Source: HHS OCR Breach Portal, U.S. Department of Health and Human Services, Office for Civil Rights ·about this source
Records are reproduced as published; entity names and figures are OCR's.
Printed from infosecsignals.com. Every record links back to the agency that published it.
Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.
