HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Oct. 28, 2014.
- Organization as reported
- Burlington Northern Santa Fe Group Benefits Plan, TX
- Entity type as reported
- Health Plan
- Category as reported
Loss
- Location of information as reported
- Other Portable Electronic Device
- Submission date
- Oct. 28, 2014
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14946, row:6085)
- Archived copy
- Held in the private archive (provenance)
On October 27, 2014, the covered entity (CE), Burlington Northern Santa Fe Group Benefits Plan, reported a breach when a workforce member that was on a business trip lost an unsecured flash drive that contained employees’ protected health information (PHI). The flash drive contained the demographic and clinical information of 507 individuals. The CE provided breach notification to HHS, affected individuals, and the media. Following the incident, the CE sanctioned the workforce member, revised its policy limiting the ability of employees to transfer PHI to portable devices, installed encryption software, and retrained staff on its privacy and security policies. OCR obtained assurances that the CE implemented the corrective actions listed above.