HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Jan. 8, 2014.
- Organization as reported
- 101 Family Medical Group, Privacy Manager Breach, CA
- Entity type as reported
- Business Associate
- Category as reported
Theft
- Location of information as reported
- Laptop
- Submission date
- Jan. 8, 2014
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15212, row:6351)
- Archived copy
- Held in the private archive (provenance)
A laptop computer owned by Phressia, Inc., a business associate (BA) of the covered entity (CE), Family Medical Group, was stolen from the parked car of a Phreesia workforce member. In violation of the BA’s policies and procedures, both the hard drive of the laptop, and the workforce member’s Dropbox account, which was accessible through the laptop, contained the electronic protected health information (ePHI) of approximately 2,500 patients. The types of PHI involved in the breach included patients’ names, addresses, identification numbers, phone numbers, email addresses, dates of birth, social security numbers, and insurance identification numbers. Following the breach, the BA sanctioned the responsible workforce member and retrained workforce members on its privacy and security policies and procedures. The CE provided breach notification HHS, affected individuals, and the media. In response to OCR's investigation, the BA updated its policies and procedures on device and media controls and employee sanctions.