HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of April 19, 2016.
- Organization as reported
- Quarles & Brady, LLP, WI
- Entity type as reported
- Business Associate
- Category as reported
Theft
- Location of information as reported
- Laptop
- Submission date
- April 19, 2016
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14553, row:5692)
- Archived copy
- Held in the private archive (provenance)
Quarles & Brady is a business associate (BA) of the covered entities (CE), CVS Health and OptumRx. On March 16, 2016, a briefcase containing a Quarles & Brady workforce member’s laptop computer was stolen from the workforce member’s vehicle in Indianapolis. The laptop was password protected, but not encrypted, and contained the protected health information (PHI) of 7,261 individuals, in violation of the BA’s policy. The PHI included names, addresses, and medications. The CEs provided breach notification to affected individuals and the media. To resolve the issues raised in this matter, the BA disciplined the workforce member involved by issuing a formal reprimand, retrained the workforce member, and subjected the workforce member to a period of monitoring. The BA also encrypted all workforce laptops, sent emails to all workforce members reminding them that storing PHI on a computer hard drive violates its policy, and gave instructions on how to delete PHI from the hard drive. Additionally, the BA required all health law attorneys to attest to reviewing all information saved to their hard drives and removing any PHI and retrained all health law attorneys and staff on the importance of HIPAA compliance for the use of laptops. OCR obtained documented assurances from the BA that it implemented the corrective action steps described here.