HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of May 13, 2010.
- Organization as reported
- Georgetown University Hospital, DC
- Entity type as reported
- Healthcare Provider
- Category as reported
Other, Theft
- Location of information as reported
- Email, Other Portable Electronic Device
- Submission date
- May 13, 2010
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 16054, row:7193)
- Archived copy
- Held in the private archive (provenance)
An employee of the covered entity emailed protected health information (PHI) to an offsite research office (which is not itself a covered entity) in violation of the review preparatory to research protocol. The research office stored the electronic information on an external hard drive that was later stolen. The device contained the PHI of 2,416 individuals. The PHI involved in the breach included names, dates of birth, and clinical information. In response to this incident, the covered entity terminated transmission of the PHI to this research office and gave the responsible employee a verbal warning and counseling. Additionally, the covered entity undertook a review of all research affiliations involving PHI of hospital patients to confirm that appropriate documentation and procedures are in place. \