HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Dec. 28, 2012.
- Organization as reported
- HP Enterprise Services, KY
- Entity type as reported
- Business Associate
- Category as reported
Theft
- Location of information as reported
- Laptop
- Submission date
- Dec. 28, 2012
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15502, row:6641)
- Archived copy
- Held in the private archive (provenance)
An employee of a subcontractor for the covered entity's (CE) Business Associate (BA), responded to a telephone phishing attack and permitted a hacker to remotely access the laptop computer of the subcontractor. In violation of the subcontractor BA's policies, the laptop contained the protected health information (PHI) of 1,090 individuals, including names, dates of birth, diagnosis codes, and diagnosis code descriptions and some social security numbers and treatment descriptions. The CE, through its BA, provided breach notification to HHS, affected individuals, and the media, and provided substitute notice. The BA also offered a year of credit monitoring to those affected. In response to the incident, the subcontractor improved safeguards by initiating laptop audits to ensure PHI is not stored on them, re-trained employees, and applied employee sanctions by terminating the employee who failed to follow its policy. OCR obtained assurances that the corrective action listed above was completed. \ \