HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of April 28, 2016.
- Organization as reported
- Northstar Healthcare Acquisitions LLC, TX
- Entity type as reported
- Healthcare Provider
- Category as reported
Theft
- Location of information as reported
- Laptop
- Submission date
- April 28, 2016
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14542, row:5681)
- Archived copy
- Held in the private archive (provenance)
A laptop computer containing the electronic protected health information (ePHI) of 19,898 individuals was stolen from vehicle of an employee of Equalize Revenue Cycle Management (ERCM). ERCM is a business associate (BA) of Northstar Healthcare Acquisitions, LLC, the covered entity (CE). The ePHI included insurance and treatment information and other demographic information. Upon discovering the breach, the BA informed law enforcement. The BA notified the affected individuals, provided substitute notice via its website, and media notification. The BA offered one year of free credit monitoring services to affected individuals. Following the breach, the BA adopted encryption technologies, revised policies and procedures, and conducted an updated risk analysis. The BA also sanctioned the workforce members involved and retrained employees. OCR obtained assurances that the BA implemented the corrective action listed above. OCR also verified that the CE had a proper BA agreement in place, which restricted the BA’s use and disclosure of PHI and required the BA to safeguard all PHI.