HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of Aug. 15, 2013.
- Organization as reported
- Foundations Recovery Network, TN
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Laptop
- Submission date
- Aug. 15, 2013
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15344, row:6483)
- Archived copy
- Held in the private archive (provenance)
A password-word protected, unencrypted laptop was stolen from the covered entity’s (CE) employee’s car in her neighborhood. The laptop contained the protected health information (PHI) of 5,690 individuals and included patient names, dates of birth, addresses, telephone numbers, social security numbers, diagnoses, level of care, dates of service, and health insurance identifiers. The CE conducted an investigation and filed a police report. The CE provided breach notifications to HHS and affected individuals. Following the breach, the CE disabled the laptop’s access to its internal systems and changed the passwords. The employee was formally reprimanded and retrained. The CE hired experts to perform a risk assessment and gap analysis of its existing privacy and security practices, policies, and procedures and instituted a policy prohibiting workforce members from removing unencrypted company laptops from the premises. The CE retrained employees at all levels on its HIPAA policies and procedures and provided company-wide email reminders to all workforce members regarding privacy and security protections. The CE established roles to address compliance, including a compliance committee and a compliance director. OCR obtained assurances that the corrective actions listed above were taken. Two of the three individuals involved in the theft of the laptop were arrested.