HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of Nov. 5, 2012.
- Organization as reported
- Henry Ford Health System, MI
- Entity type as reported
- Healthcare Provider
- Category as reported
Loss
- Location of information as reported
- Other, Other Portable Electronic Device
- Submission date
- Nov. 5, 2012
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15545, row:6684)
- Archived copy
- Held in the private archive (provenance)
Henry Ford Health System, the covered entity (CE) reported breaches that occurred on September 24, 2010, January 31, 2011, August 5, 2011, and October 23, 2014. OCR consolidated the breaches into one investigation because the breaches contained similar issues and each breach involved employees who failed to follow the CE’s policies or procedures. The September 24, 2010, breach affected 3,700 individuals and occurred when a laptop computer was stolen from an office left unlocked by an employee for approximately four hours while the employee was attending a meeting. The January 31, 2011, breach affected 2,777 individuals and occurred when an employee lost a personal portable electronic device (a “flash” drive) containing protected health information (PHI). The August 5, 2011, breach affected 520 individuals and occurred when an unencrypted desktop computer was stolen from a lab with secure access for workforce members. The desktop computer had been purchased directly by the department instead of through the CE’s established computer purchase procedures. The October 23, 2014, breach affected 2,336 individuals and occurred when a physician lost a flash drive. The physician failed to adhere to the CE’s policy mandating use of the CE’s issued flash drives and padlock. The PHI involved in the breaches included clinical and demographic information. The CE provided breach notification to the affected individuals, the media, and HHS. To resolve the issues raised in these matters, the CE took the following voluntary actions: 1) sanctioned the employees involved in the breaches depending on the severity of the employees’ noncompliance; 3) following the September 24, 2010 breach, implemented an encryption process to purchase 2,000 additional encryption licenses; 4) and on March 14, 2011, implemented a program for receiving and using encrypted flash drives. OCR obtained documented assurances that the CE implemented the corrective actions noted above. After OCR provided…