Peachtree Immediate Care Unauthorized Access Breach Report

Opening Summary

On January 23, 2023, Peachtree Immediate Care FP, LLC, a healthcare provider operating in Georgia, reported a breach of protected health information (PHI) affecting 2,555 individuals. The breach involved unauthorized access and disclosure of patient records maintained in paper and film formats. This incident represents a significant privacy violation under the Health Insurance Portability and Accountability Act (HIPAA) and required mandatory notification to affected patients, the media, and the U.S. Department of Health and Human Services (HHS).

Discovery and Response Timeline

The breach was discovered through internal audit procedures at Peachtree Immediate Care FP, LLC, which identified unauthorized access to paper-based patient records and physical film materials. Upon discovery, the organization initiated a comprehensive investigation to determine the scope of the breach, identify which specific patient records were compromised, and assess the sensitivity of exposed information. The entity submitted its breach notification to the HHS Office for Civil Rights on January 23, 2023, indicating that notification to affected individuals had been completed or was in progress at that time. The organization's response included securing the affected records, conducting a full audit of access logs and physical security measures, and implementing corrective action plans to prevent future unauthorized access incidents.

Breach Mechanism and Operational Impact

The breach involved unauthorized access to paper records and films—physical documents rather than digital systems. This classification suggests the breach may have resulted from inadequate physical security controls, such as unsecured storage areas, missing or improperly maintained access logs, or failure to implement proper document handling procedures. Paper-based breaches typically occur through scenarios including: unauthorized personnel accessing medical records storage areas, theft of physical files, improper disposal of records, or failure to restrict access to sensitive filing systems. The location designation of "Paper/Films" indicates this was not a cybersecurity incident but rather a physical security failure. Such breaches are particularly concerning because they often go undetected longer than digital breaches, as there may be no electronic audit trail to identify when records were accessed or by whom.

Organizational Context

Peachtree Immediate Care FP, LLC operates as an immediate care facility in Georgia, providing urgent and emergency medical services to the local community. Immediate care centers typically maintain extensive patient records including intake forms, medical histories, diagnostic results, treatment notes, and billing information. The involvement of a business associate in this breach indicates that Peachtree Immediate Care may have contracted with third-party vendors for services such as medical records management, billing, transcription, or document storage. Business associates are required under HIPAA to maintain the same level of security and privacy protections as covered entities, and any breach by a business associate triggers the same notification requirements. The fact that a business associate was involved suggests the unauthorized access may have occurred at a vendor location or through a vendor's systems or facilities.

Patient Impact and Affected Information

The breach affected 2,555 individuals who received care at Peachtree Immediate Care FP, LLC. These patients had their protected health information exposed through unauthorized access to paper records and physical films. While the specific data elements exposed are not detailed in the breach submission, patients of immediate care facilities typically have the following information documented in their medical records: names, addresses, dates of birth, Social Security numbers, insurance information, medical histories, diagnoses, treatment plans, medication lists, laboratory results, imaging reports, and billing/payment information. The exposure of this combination of data creates significant risk for identity theft, medical fraud, and unauthorized use of insurance information. Patients were notified of the breach through written notification letters sent to their last known addresses on file, as required by HIPAA Breach Notification Rule.

HIPAA Compliance and Industry Context

Under the HIPAA Breach Notification Rule, covered entities and business associates must notify affected individuals of any breach of unsecured PHI without unreasonable delay and no later than 60 calendar days after discovery of the breach. Additionally, entities must notify prominent media outlets if the breach affects more than 500 residents of a state or jurisdiction, and must notify the HHS Secretary. Paper-based breaches represent a persistent vulnerability in healthcare settings despite the industry's shift toward electronic health records (EHRs). According to HHS breach notification data, physical document breaches account for a significant percentage of reported incidents, often resulting from inadequate physical security controls, staff negligence, or theft. The 2,555 individuals affected in this incident falls within the medium-impact range for breach notifications. Organizations are required to conduct risk assessments following any breach to determine whether notification is necessary and to implement corrective action plans addressing the root causes. Peachtree Immediate Care's breach highlights the importance of comprehensive security programs that address both digital and physical security vulnerabilities, including employee training on proper document handling, secure storage protocols, access controls, and regular audits of physical security measures.