HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Dec. 15, 2015.
- Organization as reported
- New Mexico Department of Health, NM
- Entity type as reported
- Healthcare Provider
- Category as reported
Theft
- Location of information as reported
- Laptop
- Submission date
- Dec. 15, 2015
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14651, row:5790)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE), New Mexico Department of Health, experienced a breach of protected health information (PHI) affecting 561 individuals when a workforce member’s laptop computer was stolen out of her locked vehicle on October 4, 2015. The laptop contained patients’ names, dates of birth, diagnoses, and medications. The CE provided breach notification to HHS and affected individuals. As a result of this incident, the CE investigated the incident, modified procedures to ensure all information technology (IT) equipment is delivered directly to the IT department and all laptops are automatically encrypted. The CE also initiated a process to identify all laptops across the enterprise that did not have full disk encryption installed and revised its security awareness training to include protection/loss prevention of mobile devices. Additionally, the CE procured a mobile device management system and a security event and incident management solution and developed an implementation schedule for these tools. OCR obtained assurances from the CE that it implemented the actions listed above.