HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Feb. 2, 2018.
- Organization as reported
- Eastern Maine Medical Center, ME
- Entity type as reported
- Healthcare Provider
- Category as reported
Theft
- Location of information as reported
- Other Portable Electronic Device
- Submission date
- Feb. 2, 2018
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13925, row:5064)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE), Eastern Maine Medical Center, reported the loss of an unencrypted external computer hard drive, affecting 660 individuals. The types of protected health information (PHI) involved in the breach included patients’ names, dates of birth, dates of service, medical record numbers, procedures, physicians’ names, and locations. OCR’s investigation revealed that the external hard drive was attached to a medical imaging computer that was solely accessed and used by a business associate (BA), Biosense Webster, Inc. The CE provided breach notification to HHS, affected individuals, and the media and also offered all affected individuals one free year of identity protection services. OCR reviewed a copy of the executed BA agreement that complied with the Privacy and Security Rules. Following the breach, the CE improved security within the area where the hard drive was located and mitigated risks associated with the system. The CE also re-examined its medical devices across the organization to assess potential vulnerabilities with equipment controlled by BAs, as well as other potential security concerns. As a result of OCR’s investigation, the CE created an updated Risk Management Plan, implemented new technical safeguards, improved physical security, and retrained staff.