HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Aug. 14, 2016.
- Organization as reported
- John E. Gonzalez DDS, CA
- Entity type as reported
- Healthcare Provider
- Category as reported
Theft
- Location of information as reported
- Other Portable Electronic Device
- Submission date
- Aug. 14, 2016
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14452, row:5591)
- Archived copy
- Held in the private archive (provenance)
On July 25, 2016, Dr. John E Gonzalez’s car window was broken and his briefcase was stolen from his car. The briefcase contained an external hard drive with electronic protected health information (ePHI). Approximately 1,025 individuals were affected by the breach. The ePHI on the external hard drive contained social security numbers, phone numbers, dates of birth, physical and email addresses, health insurance information, and pictures of patients’ teeth with the patient’s first and last names listed. The CE provided breach notifications to HHS, affected individuals, and the media, as well as substitute notice. In response to the breach, the CE added safeguards to prevent unauthorized access to the data on its external hard drive and purchased an encrypted external hard drive. OCR provided the CE with technical assistance regarding breach notification and the Security Rule risk analysis and risk management provisions.