HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of May 9, 2011.
- Organization as reported
- MMM Healthcare, Inc., PR
- Entity type as reported
- Healthcare Provider
- Category as reported
Theft
- Location of information as reported
- Desktop Computer
- Submission date
- May 9, 2011
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15850, row:6989)
- Archived copy
- Held in the private archive (provenance)
Thieves broke into the MMM Healthcare, Inc. facility located in Humacao, Puerto Rico and stole four unencrypted desktop computers containing 32,390 health plan members’ electronic protected health information (ePHI). The ePHI stored in the stolen computers included names, addresses, phone numbers, Medicare numbers, diagnosis and treatment information, health plan names, health plan member identification numbers, health plan enrollment information, health care claim information, and social security numbers. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE repaired a damaged wall and improved physical security for the facility and the surrounding premises. As a result of OCR’s investigation, the CE encrypted all computers located at its regional offices. OCR obtained assurances that the CE implemented the corrective actions listed above. Additionally, OCR stated its expectation that the CE will perform a thorough and accurate risk analysis and establish a risk management plan. In addition, OCR stated its expectation that the CE will implement contingency operations procedures, implement its security policies and procedures, and regularly patch and update its IT infrastructure. OCR stated an expectation for the CE to encrypt ePHI where appropriate, and document the technical safeguards implemented to prohibit the unauthorized copying and removal of PHI and ePHI from the premises.