HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of Oct. 4, 2011.
- Organization as reported
- Indiana University, IN
- Entity type as reported
- Healthcare Provider
- Category as reported
Theft
- Location of information as reported
- Laptop
- Submission date
- Oct. 4, 2011
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15766, row:6905)
- Archived copy
- Held in the private archive (provenance)
An unencrypted and password protected laptop computer was stolen from the car of an employee (medical resident) of the covered entity (CE). The laptop contained the electronic protected health information (ePHI) of approximately 3,266 individuals. The types of ePHI in the breach included names, medical record numbers, birth dates, diagnosis codes, and social security numbers. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE audited the employee’s department and equipment, retrained the involved employee and other staff, updated its HIPAA policies and procedures, and encrypted its laptop computers. OCR obtained written assurances that the CE implemented the corrective actions listed above.