HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of June 13, 2013.
- Organization as reported
- Lucile Packard Childrens Hospital, Privacy Manager Breach, CA
- Entity type as reported
- Healthcare Provider
- Category as reported
Theft
- Location of information as reported
- Laptop
- Submission date
- June 13, 2013
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15389, row:6528)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE), Stanford School of Medicine (SOM) and Stanford Children's Hospital (SCH)(formerly Lucile Packard Children's Hospital), reported that on May 8, 2013, a workforce member’s laptop was stolen from a badge-access controlled area of the hospital. SCH employed the workforce member; however, SOM owned and managed the laptop. The laptop was password-protected, but not encrypted. The electronic protected health information (ePHI) of approximately 12,900 individuals may have been affected by this breach. The type of ePHI involved included clinical and demographic information. The CE reported the theft to law enforcement, notified the affected individuals, offered identity protection services at no cost to the affected individuals, established a toll-free call center to assist affected individuals with questions or concerns, and submitted notification to the media and HHS. Following the breach and OCR’s corresponding investigation, the CE sanctioned the workforce member for violating its HIPAA policies, ensured that SOM’s devices were encrypted and compliant with data security policies, and restricted SCH users’ ability to download attachments to unencrypted devices. The CE also initiated plans to implement an improved risk management process.