HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of May 2, 2017.
- Organization as reported
- Nova Southeastern University, FL
- Entity type as reported
- Healthcare Provider
- Category as reported
Theft
- Location of information as reported
- Other Portable Electronic Device
- Submission date
- May 2, 2017
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14198, row:5337)
- Archived copy
- Held in the private archive (provenance)
On March 2, 2017, Nova Southeaster University, the covered entity (“CE”), discovered that two unencrypted portable drives were stolen from an employee’s vehicle on February 28, 2017, potentially exposing the names and clinical information of 8,690 affected individuals. The CE provided timely breach notification to HHS, to the affected individuals and to the media. At the time of the breach and currently, the CE trained its employees on its HIPAA policies and procedures, including the storage and transportation of PHI. Following the breach, the involved employee resigned, and the CE retrained its entire clinical and laboratory workforce on its security policies and best practices and also conducted updated risk analyses. OCR obtained assurances that the CE implemented the corrective actions listed above.