HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of May 24, 2013.
- Organization as reported
- Independence Care System, NY
- Entity type as reported
- Healthcare Provider
- Category as reported
Theft
- Location of information as reported
- Laptop
- Submission date
- May 24, 2013
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15396, row:6535)
- Archived copy
- Held in the private archive (provenance)
An unencrypted laptop computer belonging to the covered entity (CE), Independence Care System, was stolen from an employee’s home. The laptop contained reports that included 2,500 members' names, addresses, telephone numbers, Medicaid identification numbers, internal identification numbers, enrollment dates, and disenrollment dates. The CE provided breach notification to HHS, affected individuals, and the media. As a result of OCR’s investigation, the CE encrypted all of it is laptop computers. The CE also updated its policies and procedures for encryption of desktop computers, laptops, and mobile devices, security, and security awareness training. Additionally, the CE performed an information security assessment of its modified IT environment and implemented the findings of the remediation plan. OCR indicated an expectation that the CE will review its updated security training to confirm whether it meets the standard of the Security Rule, conduct a risk analysis, implement a risk management plan, and implement policies and procedures for security incidents, physical security, and a facility security plan. In addition, OCR provided and expectation that the CE will provide on-going security awareness training to all staff.