HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of April 28, 2017.
- Organization as reported
- Spine Specialist, NJ
- Entity type as reported
- Healthcare Provider
- Category as reported
Theft
- Location of information as reported
- Laptop
- Submission date
- April 28, 2017
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14203, row:5342)
- Archived copy
- Held in the private archive (provenance)
The covered entity’s (CE) premises were burglarized and an unencrypted laptop computer was stolen. The laptop contained the electronic protected health information (ePHI) of 600 patients’ names, dates of birth, addresses, telephone numbers, copies of driver’s licenses, insurance information, and diagnostic reports. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE encrypted its computers, set up a cloud based electronic health record system with a two step authentication, changed its email system, performed a risk analysis and established a risk management plan. In addition, the CE improved physical security on the premises. OCR obtained assurances that the CE implemented the corrective actions listed. The CE is expected to review and revise its Privacy and Breach Notification Rules policies and procedures, its training materials, and its risk analysis and risk management plan to ensure that they identify and assess risks and reduce vulnerabilities to a reasonable and appropriate level.