HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Feb. 2, 2015.
- Organization as reported
- Boston Baskin Cancer Foundation, TN
- Entity type as reported
- Healthcare Provider
- Category as reported
Theft
- Location of information as reported
- Other Portable Electronic Device
- Submission date
- Feb. 2, 2015
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14888, row:6027)
- Archived copy
- Held in the private archive (provenance)
On December 2, 2014, a Boston Baskin Cancer Foundation employee’s laptop computer and external hard drive were stolen. The external hard drive contained the electronic protected health information (ePHI) of 56,000 individuals and included patients' names, dates of birth, social security numbers, addresses, phone numbers, clinic medical record numbers, and the first and last dates seen by the clinic. The investigation concluded that the ePHI was copied and stored on an unencrypted external hard. The covered entity (CE) provided breach notification to HHS, affected individuals, and the media, and offered affected individuals complimentary credit monitoring. In response to the breach, the CE deployed software to prevent the downloading of unencrypted documents from computers to portable media. The CE implemented a policy requiring employees to create a passcode for their mobile devices. The CE also revised its risk management policy and established procedures for the removal of hardware and electronic media containing ePHI. After the breach the CE retrained staff and physicians on its HIPAA policies. OCR obtained assurances that the CE implemented the corrective actions listed above.