HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Oct. 21, 2013.
- Organization as reported
- Mount Sinai Medical Center, NY
- Entity type as reported
- Healthcare Provider
- Category as reported
Loss
- Location of information as reported
- Other Portable Electronic Device
- Submission date
- Oct. 21, 2013
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15292, row:6431)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE), Mount Sinai Medical Center, reported that a provider’s personal unencrypted portable computer drive (a universal serial bus (USB) drive) was lost or stolen from the CE. The USB drive contained the protected health information (PHI) of 610 individuals and included names, dates of birth, medical record numbers, procedure logs, procedure dates, procedure information, and clinical information. The CE provided breach notification to HHS, the media, and the affected individuals. Following the breach, the CE sanctioned the provider, reminded all workforce members of its guidance and resources for encryption, and retrained all workforce members on HIPAA privacy and security. As a result of OCR’s investigation, the CE is expected to conduct a risk analysis, implement a corresponding remediation plan, and implement workstation security. The CE is expected to update and clarify its policies for portable devices and device and media controls and review its HIPAA training content. The CE is also expected to implement a comprehensive policy and procedure for personally owned electronic devices to ensure that they are encrypted, tracked and monitored for encryption.