HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Aug. 24, 2015.
- Organization as reported
- Lancaster Cardiology Medical Group, and Sunder Heart Institute and Vascular Medical Clinic, CA
- Entity type as reported
- Healthcare Provider
- Category as reported
Theft
- Location of information as reported
- Desktop Computer, Laptop, Network Server, Other Portable Electronic Device
- Submission date
- Aug. 24, 2015
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14725, row:5864)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE), Lancaster Cardiology Medical Group and Sunder Heart Institute & Vascular Medical Clinic, reported that sometime between June 20, 2015, and June 21, 2015, laptop computers, desktop computers, servers, and other portable electronic devices were stolen from its facility during a burglary. Approximately 2,071 individuals were affected by this breach. The types of electronic protected health information (ePHI) involved in the breach included clinical and demographic information. Following the breach, the CE promptly reported the incident to law enforcement. It provided breach notification to HHS, affected individuals, and the media. As a result of this incident, as well as OCR’s corresponding investigation, the CE implemented a plan to encrypt all ePHI stored on its devices. The CE also implemented additional physical safeguards, which included the installation of new locks and improved video surveillance. The CE updated its policies and procedures addressing administrative, technical, and physical safeguards. OCR obtained assurances that the CE implemented the corrective actions noted above.