HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Nov. 24, 2015.
- Organization as reported
- Pathways Professional Counseling, AL
- Entity type as reported
- Healthcare Provider
- Category as reported
Theft
- Location of information as reported
- Laptop
- Submission date
- Nov. 24, 2015
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14665, row:5804)
- Archived copy
- Held in the private archive (provenance)
On September 25, 2015, an employee's unencrypted, password-protected laptop computer was stolen from his vehicle. The computer contained the protected health information (PHI) of 985 patients, including addresses, names, dates of birth, clinical diagnoses, financial information, social security numbers, email addresses, physician information, health insurance information, treatment information, and medication information. The CE, Pathways Professional Counseling, provided breach notification to HHS, affected individuals, and the media. In response to this breach, the CE engaged a third party to encrypt its computers and retrain employees who may use, disclose, or access PHI. It also revised its HIPAA Compliance Plan, implemented a policy requiring encryption for mobile devices before access is granted, and implemented a policy requiring reasonable security measures when employees use their own electronic devices. The CE also sanctioned the employee involved in the breach. OCR obtained assurances that the CE implemented the corrective actions listed above.