HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of July 31, 2015.
- Organization as reported
- North East Medical Services (NEMS), CA
- Entity type as reported
- Healthcare Provider
- Category as reported
Theft
- Location of information as reported
- Laptop
- Submission date
- July 31, 2015
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14740, row:5879)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE), North East Medical Services, reported that on July 11, 2015, an unencrypted laptop computer used to store electronic protected health information (ePHI) was stolen from the trunk of a workforce member’s car. At the time of the breach, the laptop stored ePHI associated with 69,246 individuals. The ePHI included patients’ names, dates of birth, genders, contact information, payers/insurers, diagnoses, medications, treatment information, test results, appointment information, and, in some cases, social security numbers. The CE provided breach notification to HHS, affected individuals, and the media. In response to the breach, the CE implemented encryption technology. It also updated relevant policies and procedures, including its policy on the use of encryption technology and strengthened password requirements for access to ePHI. Additionally, the CE sanctioned the workforce member responsible for the breach and provided additional training to all workforce members on its policies and procedures on uses and disclosures of PHI and encryption technology, In response to OCR’s investigation, the CE performed an updated Risk Analysis.