HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Jan. 23, 2013.
- Organization as reported
- Stanford School of Medicine & LP Children Hosp, Privacy Manager Breach, CA
- Entity type as reported
- Healthcare Provider
- Category as reported
Theft
- Location of information as reported
- Laptop
- Submission date
- Jan. 23, 2013
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15482, row:6621)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE), Stanford School of Medicine (SOM) and Stanford Children's Hospital (SCH)(formerly Lucile Packard Children's Hospital), reported that on January 9, 2013, a SOM workforce member's password-protected laptop was stolen from the workforce member’s vehicle. The CE reported that the electronic protected health information (ePHI) stored on the laptop was unencrypted. The ePHI of approximately 56,500 individuals may have been affected by this incident. The ePHI included demographic and clinical information related to SCH patient care and SOM research. Following this incident, the CE contacted law enforcement, notified the affected individuals, offered identity protection services to the affected individuals, established a call center to assist affected individuals with questions or concerns, and submitted notification to the media and HHS. The CE reported that there was no evidence of unauthorized access to the ePHI stored on the laptop. As a result of the breach and OCR’s corresponding investigation, the CE sanctioned the workforce member for violating HIPAA policies, and retrained workforce members on data security policies. SCH implemented enhanced administrative and technical safeguards to ensure secure email communications; and. The CE also initiated plans to implement an improved risk management process.