HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of March 16, 2011.
- Organization as reported
- JEFFREY J. SMITH, MD, OK
- Entity type as reported
- Healthcare Provider
- Category as reported
Theft
- Location of information as reported
- Desktop Computer, Other, Other Portable Electronic Device
- Submission date
- March 16, 2011
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15884, row:7023)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE) shipped a skin analysis machine containing the electronic protected health information (ePHI) of approximately 600 individuals to the manufacturer for repairs via UPS. The machine was damaged and discarded by UPS. The ePHI included names, dates of birth and facial photographs. The CE posted breach notification on its website. As a result of OCR's investigation, the CE revised its policy regarding the security of hardware containing PHI so that all work on hardware will be performed on-site. The policy also requires that all ePHI is to be backed up and erased from the hardware prior to any unavoidable off-site maintenance.