HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Nov. 5, 2013.
- Organization as reported
- Barnabas Health Medical Group, P.C., NJ
- Entity type as reported
- Healthcare Provider
- Category as reported
Theft
- Location of information as reported
- Laptop
- Submission date
- Nov. 5, 2013
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15273, row:6412)
- Archived copy
- Held in the private archive (provenance)
An unencrypted laptop computer that was used to conduct spirometry tests was stolen from an office of the covered entity (CE), Barnabas Health Medical Group, P.C., during office hours, affecting 1,099 individuals. The types of protected health information (PHI) involved in the breach included demographic and clinical information. The CE provided breach notification to HHS, the media, and the affected individuals. Following the breach, the CE reported the theft to law enforcement, conducted an internal investigation, and conducted on-site reviews of every CE office to confirm there were no other unencrypted devices. Following the breach, the CE also retrained staff on privacy and security issues, and obtained a new spirometer with improved safeguards. OCR obtained assurances that the CE implemented the corrective actions listed. Additionally, as a result of OCR’s investigation, the CE is expected to conduct a risk analysis, implement a corresponding remediation plan, implement policies and procedures relating to biomedical devices containing electronic PHI, and regularly review records of information system activity.