HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of Oct. 29, 2013.
- Organization as reported
- Rotech Healthcare Inc., FL
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Laptop
- Submission date
- Oct. 29, 2013
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15281, row:6420)
- Archived copy
- Held in the private archive (provenance)
A former employee of the covered entity (CE), Rotech, removed and retained electronic files from a company computer, some of which contained the protected health information (PHI) of employees in relation to the CE’s group health plan. The demographic, clinical and financial information of 10,680 individuals was affected by the breach. The CE provided breach notification to HHS, affected individuals, and the media. In response to the breach, the CE updated its policies and procedures regarding downloading of information from company-issued computers to external devices, retrieval of company-issued removable media from departing employees, and destruction of PHI and ePHI. The CE improved safeguards by disabling USB ports on most computers and encrypting all company laptops. Additionally, the CE conducted a HIPAA gap analysis, implemented a process for periodic analysis, and updated and secured the methods used to back up data. Finally, the CE obtained outside experts to assist in reviewing and enhancing HIPAA training and retrained employees. OCR obtained assurances that the corrective actions listed above were completed.