HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Aug. 7, 2015.
- Organization as reported
- Baylor College of Medicine, TX
- Entity type as reported
- Healthcare Provider
- Category as reported
Theft
- Location of information as reported
- Other Portable Electronic Device, Paper/Films
- Submission date
- Aug. 7, 2015
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14734, row:5873)
- Archived copy
- Held in the private archive (provenance)
A physician’s backpack containing five unencrypted portable data drives and a handwritten notebook with the protected health information (PHI) of approximately 1,004 pediatric patients was stolen from an automobile. The types of PHI involved in the breach included names, dates of birth, hospital medical record numbers, types of surgery performed, and treating physicians’ names. One of the drives contained surgical images of twenty patients. The breach affected approximately 876 patients of Texas Children's Hospital (TCH) and 128 patients of Memorial-Hermann. The physician, a surgical fellow for the covered entity (CE), Baylor College of Medicine, reported the theft to the police and notified TCH. TCH initiated an investigation and notified the CE of the breach on July 15, 2015. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE distributed an acknowledgment and attestation document to each medical resident and fellow addressing the CE’s patient privacy and security policies, including incident reporting procedures. Due to OCR’s involvement, all residents, fellows and learners are required to complete the acknowledgment and attestation at the beginning of each academic year. The CE also initiated a policy to require the acknowledgment and attestation to be included in each graduate medical education program participant’s contract at the beginning of each academic year.