HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Nov. 4, 2016.
- Organization as reported
- Kinetorehab Physical Therapy, PLLC, NY
- Entity type as reported
- Healthcare Provider
- Category as reported
Theft
- Location of information as reported
- Laptop
- Submission date
- Nov. 4, 2016
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14379, row:5518)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE) reported that an unencrypted laptop computer was stolen when it was left outside the office in an unattended bag. The laptop contained the electronic protected health information (ePHI) of 665 patients’ names, dates of birth, addresses, social security numbers, and physical therapy/clinical notes. The CE provided breach notification to HHS, the affected individuals, and the media. Following the breach, the CE installed encryption software and a security cable lock on its replacement computer to prevent another theft. OCR obtained assurances that the CE implemented the corrective actions listed above. Additionally, the CE is expected to review and revise its HIPAA policies and procedures and training materials and train all workforce members. It is also expected to perform a thorough and accurate risk analysis that addresses all potential risks and vulnerabilities in the entire operation with respect to the uses and disclosures of ePHI and develop and implement a risk management plan that addresses the process for managing and reducing the risks identified in the risk analysis to a reasonable and appropriate level.