HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of Jan. 8, 2018.
- Organization as reported
- Charles River Medical Associates, pc, MA
- Entity type as reported
- Healthcare Provider
- Category as reported
Loss
- Location of information as reported
- Other Portable Electronic Device
- Submission date
- Jan. 8, 2018
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13947, row:5086)
- Archived copy
- Held in the private archive (provenance)
In November 2017, Charles River Medical Associates, the covered entity (CE), discovered that an unencrypted, portable hard drive used to store monthly backups of bone density studies was missing from the bone density testing workstation, affecting 9,387 individuals. The types of protected health information (PHI) involved included patients' names, dates of birth, patients' identification numbers, and radiology images. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE applied appropriate sanctions, retrained its workforce, and conducted an audit of hardware containing electronic PHI, resulting in the replacement of two additional portable devices not in compliance with its policies. OCR reviewed the CE’s policies and procedures and obtained assurances that the CE implemented the corrective actions listed above.