HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Aug. 3, 2017.
- Organization as reported
- Spectrum Health System, MI
- Entity type as reported
- Healthcare Provider
- Category as reported
Theft
- Location of information as reported
- Other Portable Electronic Device
- Submission date
- Aug. 3, 2017
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14105, row:5244)
- Archived copy
- Held in the private archive (provenance)
On June 22, 2017, a digital camera with stored photographs of patients’ chart labels and photographs of patients’ skin conditions was stolen out of a physician’s vehicle which was parked outside the physician’s home. The stolen camera contained protected health information (PHI) created between February 15, 2017, and June 21, 2017, including 902 individuals’ demographic and clinical information. The physician reported the theft to law enforcement. The covered entity (CE) provided breach notification to HHS, affected individuals, and the media, posted substitute notice on its website, and established a call center to answer patients’ questions and public inquiries. Following the breach, the CE updated its policies and procedures for safeguarding PHI on mobile devices, requiring employees to install encryption software on all CE-approved cell phones and mobile devices and banning the removal of cameras and camera memory cards from the CE’s premises. The CE also trained workforce members on securely capturing and storing electronic PHI on mobile devices. In October 2018, the CE began a comprehensive enterprise wide risk analysis that continued into 2019. OCR obtained documented assurances that the CE implemented the corrective actions listed above.