HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Feb. 12, 2014.
- Organization as reported
- Lewis J. Sims, DPM, PC dba Sims and Associates Podiatry, NY
- Entity type as reported
- Healthcare Provider
- Category as reported
Other, Theft
- Location of information as reported
- Laptop
- Submission date
- Feb. 12, 2014
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15179, row:6318)
- Archived copy
- Held in the private archive (provenance)
Three laptop computers belonging to the covered entity (CE), Sims & Podiatry Associates’, were stolen from its office. The laptops were unencrypted and contained electronic protected health information (ePHI) that included 6,474 patients’ addresses, zip codes, dates of birth and vascular test results. The CE provided breach notification to HHS, affected individuals, and the media. As a result of OCR’s investigation, the CE installed new locks on all its doors and an alarm security system with central station monitoring. The CE also purchased replacement laptops and a new server. Additionally, the CE secured all laptops with cable locks and implemented full disk encryption along with antivirus and anti-malware software. Further, the CE implemented real-time offsite backup of all its ePHI. OCR specified its expectation that the CE conduct an on-going risk analysis, implement an on-going risk management plan, conduct periodic vulnerability scans and penetration tests, implement audit controls and perform information system activity review. Further, OCR expects the CE to upgrade encryption for the Poughkeepsie office and ensure that portable hard drives are stored in a secured location. The CE is also expected to provide on-going security awareness training to all staff.