HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Jan. 9, 2015.
- Organization as reported
- Henry Ford Health System, MI
- Entity type as reported
- Healthcare Provider
- Category as reported
Loss
- Location of information as reported
- Other, Other Portable Electronic Device
- Submission date
- Jan. 9, 2015
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14903, row:6042)
- Archived copy
- Held in the private archive (provenance)
Henry Ford Health System, the covered entity (CE), reported a breach that occurred on October 23, 2014, when a physician lost a portable electronic device (a “flash” drive). The physician failed to adhere to the CE’s policy mandating use of employer-issued flash drives and padlocks. The breach affected 2,336 individuals. The protected health information (PHI) involved in the breach included clinical and demographic information. Following the breach, the CE provided breach notification to affected individuals, the media, and HHS. It also sanctioned the employee involved in the breach based on the severity of the noncompliance. OCR obtained documented assurances that the CE implemented the corrective action steps above. After OCR provided substantial technical assistance to the CE on the Security Rule’s Risk Analysis requirements, the CE provided written assurances to OCR that it will: create a more robust asset management program over the next 6-8 months and would provide that documentation to OCR; complete an enterprise data mapping and asset inventory by December 31, 2017; and 3) submit a fully executed copy of the business associate agreement (BAA) to OCR upon signature of a Master Service Agreement (MSA) and Statement of Work (SOW) for data mapping services once its vendor is chosen. This review was consolidated into an existing investigation of the CE.