HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Dec. 31, 2013.
- Organization as reported
- Barry University, FL
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Laptop, Network Server
- Submission date
- Dec. 31, 2013
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15223, row:6362)
- Archived copy
- Held in the private archive (provenance)
Barry University, the covered entity (CE), discovered on May 13, 2013, that a laptop was infected with malware. The protected health information (PHI) for 8,741 individuals was potentially exposed, including names, dates of birth, social security numbers, driver’s license numbers, banking/credit card information, medical record numbers, health insurance information, diagnoses, and treatment information. Due to a lengthy investigation, the CE performed its breach notification obligations outside of the 60 day timeframe required by the Breach Notification Rule. OCR provided technical assistance to the CE on this topic. Although late, the CE provided breach notification to HHS, affected individuals, and the media, as well as on its website. In response to the breach, the CE retained a compliance consultant, performed a risk assessment, revised its policies and procedures, improved its training program and implemented additional technical safeguards. OCR obtained assurances that it has implemented the corrective actions listed above.