HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Oct. 14, 2016.
- Organization as reported
- Gibson Insurance Agency, Inc., IN
- Entity type as reported
- Business Associate
- Category as reported
Theft
- Location of information as reported
- Laptop
- Submission date
- Oct. 14, 2016
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14391, row:5530)
- Archived copy
- Held in the private archive (provenance)
On July 28, 2016, an employee’s laptop computer was stolen from her car. The laptop may have contained the demographic and health insurance information of approximately 7,242 individuals. The employee reported the theft to local law enforcement, and the covered entity (CE), Gibson Insurance Agency, Inc., provided breach notification to HHS, affected individuals, and the media. Following the incident, the CE investigated the breach, sanctioned the employee involved, implemented policies regarding the use of portable workstations outside the office, and retrained employees. The CE improved safeguards by encrypting all computers, deploying a security management system to all mobile devices, mandating the use of complex passwords, and instituting automatic logoff. OCR reviewed the CE’s policies and procedures relating to the disclosure, breach, safeguarding of PHI, and sanctions and obtained assurances that the CE implemented the corrective actions noted above.