HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of April 5, 2011.
- Organization as reported
- Hartford Hospital, CT
- Entity type as reported
- Business Associate
- Category as reported
Theft
- Location of information as reported
- Other
- Submission date
- April 5, 2011
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15873, row:7012)
- Archived copy
- Held in the private archive (provenance)
A workforce member of the covered entity's (CE) business associate (BA) saved the electronic protected health information (ePHI) of approximately 93,500 patients on an unsecured computer drive in order to do work from home, and subsequently lost the hard drive. The PHI included names, addresses, dates of birth, marital status, social security numbers and medical record numbers. Following the breach, the workforce member involved was sanctioned for violating the CE's policies. The CE provided breach notification to the media, HHS, and all affected individuals. It also offered all affected individuals 2 years of free identity protection services. In addition, the CE disabled the ability for all of its computing devices to download ePHI via USB connection ports. Further, it began implementing malicious software prevention utilities as well as data encryption controls to supplement its portable computing devices. OCR obtained assurances that the CE implemented the corrective action listed above. The breach incident involved a BA and occurred prior to the September 23, 2013, compliance date. OCR verified that the CE had a proper BA agreement in place that restricted the BA's use and disclosure of PHI and required the BA to safeguard all PHI. \ \ \ \