HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Feb. 5, 2018.
- Organization as reported
- City of Detroit, MI
- Entity type as reported
- Healthcare Provider
- Category as reported
Loss
- Location of information as reported
- Other Portable Electronic Device
- Submission date
- Feb. 5, 2018
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13923, row:5062)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE), City of Detroit, reported that an unencrypted flash drive containing protected health information (PHI) had been reported missing. Subsequently, an employee located the flash drive and returned it to his/her supervisor. The breach affected 544 individuals. The PHI involved included names, dates of birth, addresses, Social Security numbers, diagnoses/conditions, lab results, medications, and other treatment information. Upon discovering the breach, the CE notified OCR, the affected individuals, and media outlets. The breach was also reported to the New Jersey State Police Cyber Crimes Unit. As a result of the breach, the CE implemented new encryption technology for mobile data storage devices. The CE also revised its policies and procedures regarding employee access to PHI and PII, and retrained its employees. OCR obtained assurances that the CE implemented the corrective actions noted above.