HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of Nov. 13, 2013.
- Organization as reported
- Memorial Sloan-Kettering Cancer Center, NY
- Entity type as reported
- Healthcare Provider
- Category as reported
Loss
- Location of information as reported
- Other Portable Electronic Device
- Submission date
- Nov. 13, 2013
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15264, row:6403)
- Archived copy
- Held in the private archive (provenance)
Memorial Sloan Kettering Cancer Center, the covered entity (CE), reported that a former employee’s personal unencrypted external computer hard drive was lost or stolen. The drive contained the protected health information (PHI) of 2,279 of the CE’s patients and included names, addresses, telephone numbers, dates of birth, medical record numbers, physician names, appointment dates, procedure type, and clinical information. The CE notified HHS, the media, and the affected individuals. Following the breach, the CE obtained assurances from the employee and his current employer that the PHI was deleted from all devices, computers and servers. The CE purchased and implemented an encryption solution to encrypt all data copied from its workstations, USB and external drives. The CE retrained employees on its HIPAA policies and procedures and reinforced its policies prohibiting the use of personal portable electronic data storage devices. During the investigation, OCR obtained assurances that the CE implemented the corrective actions. The CE is expected to conduct a risk analysis and implement a corresponding risk management plan.