HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of July 8, 2014.
- Organization as reported
- Haley Chiropractic Clinic, WA
- Entity type as reported
- Healthcare Provider
- Category as reported
Theft
- Location of information as reported
- Desktop Computer, Laptop
- Submission date
- July 8, 2014
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15046, row:6185)
- Archived copy
- Held in the private archive (provenance)
One laptop and two desktop computers containing the electronic protected health information (ePHI) of about 6,000 patients were stolen during a break-in at the covered entity (CE), Haley Chiropractic Clinic. The machines and the clinic’s electronic health record (EHR) application were password-protected, but the devices were not encrypted. One of the desktop computers provided access to the web-based EHR system that included names, treatment notes, addresses, phone numbers, dates of birth, insurance information, and social security numbers. The stolen laptop contained patients’ names, social security numbers, height and weight, and range of motion data. The CE filed a police report, provided breach notification to HHS, affected individuals, and the media, and posted substitute notice on its website. Following the breach, the CE improved safeguards by installing a new physical security alarm and video surveillance system, changing all computer passwords, and encrypting computers. OCR’s review found that the media notice did not comply with the content requirements of the Breach Notification Rule. Based on OCR’s technical assistance, the CE provided a compliant notice to regional media.