Midwest Orthopaedic Center SC
Disclosed Jul 23, 201412 years ago680 affectedConfirmed
A former affiliate of the covered entity’s (CE) former business associate(BA), McKesson Corporation, that provided specialized billing services, unintentionally made records containing patient information potentially accessible on the Internet. The protected health information (PHI) of approximately 680 individuals was accessible using very specific Google search terms between December 1, 2013 and April 17, 2014. The former BA immediately safeguarded the information and made it inaccessible on the Internet. The former BA confirmed that the web server was properly removed from public Internet access, confirmed from its former affiliate that the data at issue was destroyed, contacted Google to ensure all caches pages were destroyed, and confirmed the information could not be accessed through any web search. The former BA also confirmed with its former affiliate that no other information was available via the computer server at issue or any other server. The CE confirmed that the former BA’s policies related to data security were in compliance with the CE’s data security requirements. The CE provided breach notification to HHS, affected individuals, and the media, and offered credit m
What is known
| People affected | 680 (as reported to HHS) |
|---|---|
| Disclosed | Jul 23, 2014 |
| Happened | Dec 1, 2013 |
| Attack | Insider |
| Data exposed | Names, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| Indiana Attorney General 2014 data breach report: Midwest Orthopaedic Center SCin.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): Midwest Orthopaedic Center SC (Business Associate, IL)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| Indiana AGresidents of IN | Jul 23, 2014 | 1 |
| HHS archivetotal | Jul 23, 2014 | 680 |
History of this record
- 2026-09-25 · attack: unknown to insider · backfill source
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · records_basis: empty to hhs · backfill source
- 2026-09-25 · records: empty to 680 · backfill source
- 2026-09-25 · summary: empty to A former affiliate of the covered entity’s (CE) former business associate(BA), McKesson Corporation, that provided specialized billing services, unintentionally made records containing patient information potentially accessible on the Inter · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (Indiana AG), confirmed by Indiana AG. Record counts are as reported. Not legal advice.