HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of June 4, 2015.
- Organization as reported
- Stanislaus Surgical Hospital, CA
- Entity type as reported
- Healthcare Provider
- Category as reported
Theft
- Location of information as reported
- Desktop Computer, Other Portable Electronic Device, Paper/Films
- Submission date
- June 4, 2015
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14782, row:5921)
- Archived copy
- Held in the private archive (provenance)
On April 4, 2015, two paper binders containing the protected health information (PHI) of up to 1,166 individuals were stolen from one of the covered entity’s (CE) facilities along with several other items that did not contain PHI. The type of PHI involved in the breach was financial information. The CE filed a formal police report and police identified two potential suspects. The CE provided breach notification to HHS, affected individuals, and the media and offered credit monitoring to all individuals affected. Following the breach, the CE improved physical security for the facility and the locked file cabinets that contain PHI and updated security procedures for employees’ access to the premises. It also converted its payment system to a paperless, all electronic system and implemented an encryption requirement for all information that is stored on a shared drive. The CE also trained all employees on the changes to its security policies and procedures. OCR obtained assurances that the CE implemented the corrective actions listed.