HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of May 15, 2017.
- Organization as reported
- Pacific Ocean Pediatrics, CA
- Entity type as reported
- Healthcare Provider
- Category as reported
Theft
- Location of information as reported
- Other Portable Electronic Device
- Submission date
- May 15, 2017
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14187, row:5326)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE), Pacific Ocean Pediatrics, reported a breach when three computers and two external hard drives were stolen from the CE’s office after a cleaning crew member left an exterior door unlocked. The breach affected approximately 18,637 individuals, who were the CE’s patients and parents of patients. The protected health information (PHI) included names, addresses, dates of birth, phone numbers, sex, insurance information, and entire charted medical history of patients including symptoms, tests, diagnosis, and prescriptions. The CE immediately reported the theft to law enforcement. The CE provided timely breach notification to HHS, affected individuals, and the media. Substitute notice was also provided. The CE consulted with an IT professional to implement additional protective measures to prevent a similar breach occurring in the future. Following the incident, the CE improved physical security at its facility, installed a firewall, encrypted electronic devices that store PHI, and adopted new and revised policies and procedures to safeguard PHI. The CE has trained workforce members on the new and revised policies. OCR obtained assurances that the CE implemented the corrective actions noted above. OCR also provided the CE technical assistance regarding the risk analysis and risk management provisions of the Security Rule.