HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of March 29, 2013.
- Organization as reported
- Sunil Kakar, Psy.D., WA
- Entity type as reported
- Business Associate
- Category as reported
Theft
- Location of information as reported
- Laptop
- Submission date
- March 29, 2013
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15434, row:6573)
- Archived copy
- Held in the private archive (provenance)
On February 4, 2013, a personal laptop computer used to store medical reports and information about the covered entity’s (CE) clients was lost by, or stolen from, a provider formerly contracted by the CE. The computer's hard drive was wiped before it could be determined what information it contained, but the CE treated it as a breach affecting 629 individuals. The protected health information (PHI) involved in the breach may have included names, dates of birth, social security numbers, and clinical information, such as diagnoses or conditions. Following the breach, the CE updated contract language with business associates and contractors to include data security requirements and additional physical controls, as well as a self-assessment tool and monitoring plan. The CE added provisions to require contracted providers to provide proof of annual completion of a self-assessment tool and verification of encryption software use. OCR provided technical assistance on the Security Rule requirements and obtained assurances that breach notification was provided in accordance with the Breach Notification Rule requirements.