HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of March 6, 2015.
- Organization as reported
- San Franciso General Hospital and Trauma Center, CA
- Entity type as reported
- Healthcare Provider
- Category as reported
Theft
- Location of information as reported
- Other
- Submission date
- March 6, 2015
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14862, row:6001)
- Archived copy
- Held in the private archive (provenance)
A physician formerly affiliated with a business associate, the University of California, San Francisco (UCSF) removed patients’ electronic protected health information (ePHI) from the covered entity (CE), San Francisco General Hospital and Trauma Center , without authorization. The CE estimated that approximately 2,500 individuals were affected by the breach. The types of ePHI affected included patients’ names, surgical notes, consultation notes, and radiologic films. The CE provided breach notification to affected individuals, the media, and HHS. In response the breach, the CE implemented new HIPAA Privacy and Security policies and procedures, including a new/updated Security Rule Risk Management Plan and Security Risk Analysis, new technological safeguards, periodic technical and non-technical evaluations, and trained and retained workforce members . OCR obtained assurances that the CE implemented the corrective actions noted above.