Southwest Gastroenterology
Disclosed Jun 28, 20197 years ago1,600 affectedConfirmed
The covered entity (CE), Southwest Gastroenterology, reported that an employee impermissibly accessed the electronic protected health information (ePHI) of approximately 1,600 individuals. The ePHI involved included names, addresses, dates of birth, Social Security numbers, and health insurance information. The CE notified HHS, affected individuals, the media, and provided substitute notice. The CE also provided free credit monitoring services to the affected individuals. In response to the breach, the CE implemented additional administrative and technical safeguards. OCR provided the CE with technical assistance regarding the HIPAA Security Rule.
What is known
| People affected | 1,600 (as reported to HHS) |
|---|---|
| Disclosed | Jun 28, 2019 |
| Happened | Jan 1, 2012 |
| Attack | Lost or stolen device |
| Data exposed | Names, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| Indiana Attorney General 2019 data breach report: Southwest Gastroenterologyin.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): Southwest Gastroenterology (Healthcare Provider, IL)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| Indiana AGresidents of IN | Jun 28, 2019 | 17 |
| HHS archivetotal | Jun 28, 2019 | 1,600 |
History of this record
- 2026-09-25 · attack: unknown to lost-device · backfill source
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · records_basis: empty to hhs · backfill source
- 2026-09-25 · records: empty to 1600 · backfill source
- 2026-09-25 · summary: empty to The covered entity (CE), Southwest Gastroenterology, reported that an employee impermissibly accessed the electronic protected health information (ePHI) of approximately 1,600 individuals. The ePHI involved included names, addresses, dates · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (Indiana AG), confirmed by Indiana AG. Record counts are as reported. Not legal advice.