HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of March 15, 2012.
- Organization as reported
- Georgia Health Sciences University, GA
- Entity type as reported
- Healthcare Provider
- Category as reported
Theft
- Location of information as reported
- Laptop
- Submission date
- March 15, 2012
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15670, row:6809)
- Archived copy
- Held in the private archive (provenance)
On January 19, 2012, the covered entity’s (CE) employee discovered that her laptop computer was stolen from the front porch of her home. The laptop contained the electronic protected health information (ePHI) of 513 patients, including names, dates of birth, and health data. The laptop lacked virtual private network connectivity and the data was password protected but not encrypted. The CE provided breach notification to HHS, affected individuals, and the media. In response to the breach, the CE encrypted all employee laptops, implemented a mobile device and remote access policy and updated its electronic data backup policy. The CE also trained staff on its HIPAA Privacy and Security policies. Additionally, the CE counseled the employee for failure to maintain physical security of the CE’s property. OCR obtained assurances that the CE implemented the corrective actions listed above.