HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of April 22, 2016.
- Organization as reported
- Edwin Shaw Rehabilitation, OH
- Entity type as reported
- Healthcare Provider
- Category as reported
Loss
- Location of information as reported
- Other
- Submission date
- April 22, 2016
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14548, row:5687)
- Archived copy
- Held in the private archive (provenance)
On February 19, 2016, an employee of the covered entity (CE), Edwin Shaw Rehabilitation, mistakenly left behind a day planner that contained an unencrypted mobile computer drive (a universal serial bus, or “USB” drive), at a business-related function. The drive contained a spreadsheet file that included the names, medical record numbers, insurance providers’ names, and limited clinical information of 975 individuals. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE sanctioned the involved employee, conducted mandatory privacy and security training for all members of its leadership team, and implemented a month-long security awareness campaign for all employees that included HIPAA education and collection of unencrypted USB drives. The CE also deployed new forms for employees to request an encrypted mobile computer drive. OCR obtained written assurances that the CE implemented the corrective actions noted above.