HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of June 14, 2017.
- Organization as reported
- Bay Area Pain and Wellness Center, CA
- Entity type as reported
- Healthcare Provider
- Category as reported
Theft
- Location of information as reported
- Laptop
- Submission date
- June 14, 2017
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14166, row:5305)
- Archived copy
- Held in the private archive (provenance)
On May 8, 2017, the covered entity (CE), Bay Area Pain and Wellness Center, discovered that its Electromyography (EMG) machine was stolen from an employee's car. A laptop computer attached to the EMG contained the electronic protected health information (ePHI) of approximately 548 patients. The ePHI included patients' names and dates of birth. The laptop was password protected but not encrypted. The CE provided breach notification to HHS, affected individuals and the media, as well as providing substitute notification. In response to the breach, the CE retrained its employees on its Privacy and Security Rule policies, encrypted employees’ laptops, and updated its Security Rule policy to prohibit employees from leaving computer and computer bags in unattended public areas. OCR provided the CE with technical assistance regarding breach notification and the Security Rule risk analysis and risk management provisions.