HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Nov. 14, 2013.
- Organization as reported
- Health Fitness Corporation, IL
- Entity type as reported
- Business Associate
- Category as reported
Theft
- Location of information as reported
- Laptop
- Submission date
- Nov. 14, 2013
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15263, row:6402)
- Archived copy
- Held in the private archive (provenance)
An unencrypted company laptop was stolen from the car of the business associate’s (BA) employee. The laptop contained the protected health information (PHI) of 3,804 individuals and included employees and/or spouses names, birthdates, health plan election, and social security numbers. The covered entity (CE) provided breach notification to HHS and the BA provided breach notification to affected individuals and the media. In response to this incident, the CE implemented a policy requiring encryption on all laptops containing PHI. The CE trained employees and provided refresher training regarding mobile device encryption. The BA implemented a new certification process to ensure client owned mobile devices are encrypted. OCR obtained assurances that the corrective actions listed above were taken.