HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of April 18, 2012.
- Organization as reported
- Emory Healthcare, GA
- Entity type as reported
- Healthcare Provider
- Category as reported
Other, Unknown
- Location of information as reported
- Other
- Submission date
- April 18, 2012
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15649, row:6788)
- Archived copy
- Held in the private archive (provenance)
On February 20, 2012, the covered entity (CE), Emory Healthcare, discovered that ten unencrypted back-up compact disks (CDs) containing electronic protected health information (ePHI) were missing. The types of ePHI involved in the breach included clinical and demographic data for 315,000 surgical patients treated at three locations between September 1990 and April 2007. The information on the CDs could only easily be read using decommissioned software. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE required every department to inventory and properly store or destroy PHI. It also distributed educational material to all staff. OCR obtained assurances that the CE implemented the corrective actions listed above.