HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of Oct. 8, 2015.
- Organization as reported
- Insurance Data Services, MI
- Entity type as reported
- Business Associate
- Category as reported
Theft
- Location of information as reported
- Paper/Films
- Submission date
- Oct. 8, 2015
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14696, row:5835)
- Archived copy
- Held in the private archive (provenance)
On September 15, 2015, a zippered bag was stolen from a delivery service vehicle with month-end reports for Insurance Data Services, a business associate (BA) of the covered entity (CE), Claystone Clinical Associates. The BA reported that this breach affected 2,918 individuals. The types of protected health information (PHI) involved in the breach included patients’ names, dates of service, balances, insurance providers, diagnostic and procedure codes, addresses, and phone numbers. The BA investigated the breach and assured that the theft was reported to the police. The BA provided breach notification to HHS, affected individuals, and the media. The BA also updated its procedures to utilize a secure client portal to transmit PHI with clients. As a result of OCR’s investigation the BA created policies and procedures relating to safeguarding PHI, using and disclosing PHI, and Breach Rule Notification and trained its staff on its policies. OCR obtained written assurances that the CE completed the corrective actions listed.