HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Nov. 15, 2010.
- Organization as reported
- Henry Ford Hospital, MI
- Entity type as reported
- Healthcare Provider
- Category as reported
Theft
- Location of information as reported
- Laptop
- Submission date
- Nov. 15, 2010
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15943, row:7082)
- Archived copy
- Held in the private archive (provenance)
Henry Ford Health System, the covered entity (CE), reported that a breach occurred on September 24, 2010, that affected 3,700 individuals and occurred when a laptop computer was stolen from an office left unlocked by an employee for approximately four hours while the employee was attending a meeting. The PHI involved in the breach included clinical and demographic information. The CE provided breach notification to the affected individuals, the media, and HHS. To resolve the issues raised by the breach, the CE sanctioned the employee involved in the breach based on the severity of the employee’s noncompliance, implemented an encryption process to purchase 2,000 additional encryption licenses, and implemented a program for receiving and using encrypted flash drives on March 14, 2011. OCR obtained documented assurances that the CE implemented these corrective action steps. After OCR provided substantial technical assistance to the CE on the Security Rule’s Risk Analysis requirements, the CE provided written assurances to OCR that it will: create a more robust asset management program over the next 6-8 months and provide documentation to OCR; complete an enterprise data mapping and asset; and submit a fully executed copy of the business associate agreement (BAA) to OCR upon signature of a Master Service Agreement (MSA) and Statement of Work (SOW) for data mapping services once its vendor is chosen. This case was consolidated into an existing investigation of the CE.