HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Oct. 20, 2015.
- Organization as reported
- Huntington Medical Research Institutes, CA
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Laptop, Other Portable Electronic Device
- Submission date
- Oct. 20, 2015
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14682, row:5821)
- Archived copy
- Held in the private archive (provenance)
A workforce member took 4,300 patients’ protected health information (PHI) with her on several external computer hard drives when her employment with the covered entity (CE), Huntington Medical Research Institutes was terminated. The types of PHI involved in the breach included, variously, financial, demographic and financial information. The CE provided substitute notice, notice to the media, and notice to OCR pursuant to the requirements of the Breach Notification Rule. Following the breach, the CE worked with the workforce member’s counsel to recover the PHI in a secure manner and engaged a forensic expert to confirm that all PHI was recovered. The CE also reassigned privacy and security responsibilities and began considering the need to augment its privacy and security staff. The CE improved safeguards by encrypting all computer workstations, as well as phones that access PHI. In response to OCR’s investigation, the CE developed a comprehensive enterprise-wide risk analysis report and corresponding risk management plan.