HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of May 27, 2011.
- Organization as reported
- Spartanburg Regional Healthcare System, SC
- Entity type as reported
- Healthcare Provider
- Category as reported
Theft
- Location of information as reported
- Desktop Computer
- Submission date
- May 27, 2011
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15840, row:6979)
- Archived copy
- Held in the private archive (provenance)
Three unencrypted desktop computers and one unencrypted laptop computer in need of repair were stolen from an IT employee’s vehicle when he stopped at his home when transporting the equipment from an offsite location to the main hospital. The home stop was against the CE’s internal policies and procedures and exposed the protected health information (PHI) of 402,647 patients, including names, addresses, dates of birth and social security numbers. The CE provided breach notification to HHS, affected individuals, and the media and also offered affected individuals one year of free credit monitoring. In response to the breach, the CE revised its new employee and upper management orientation materials to reflect updated HIPAA revisions. The CE encrypted all of the hard drives on its computers. It also updated policies and procedures regarding electronic data and use of company vehicles. Additionally, the CE began distributing an information security newsletter to employees. The CE sanctioned the involved employee for violating the CE’s handling of computer equipment policy. OCR obtained assurances that the CE implemented the corrective actions listed above.