HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of May 16, 2016.
- Organization as reported
- Surgical Care Affiliates, AL
- Entity type as reported
- Business Associate
- Category as reported
Theft
- Location of information as reported
- Laptop
- Submission date
- May 16, 2016
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14526, row:5665)
- Archived copy
- Held in the private archive (provenance)
Surgical Care Affiliates, the covered entity (“CE”), discovered that on March 17, 2016, a laptop computer had been stolen from an employee’s house. The laptop was password protected; however the employee’s username and password were with the laptop at the time of the theft. There was no patient information stored on the laptop, but Outlook emails were potentially cached on the hard drive. The CE opened an internal investigation and determined that 9,009 individuals may have had their names, addresses, dates of birth, social security numbers, treatment information, and health insurance information exposed as a result of this incident. The CE provided timely breach notification to HHS, to affected individuals, on its website, and to the media. In response to the breach, the CE retrained the employee involved to reinforce its existing HIPAA policies pertaining to the safeguarding of electronic devices and password management, and provided free credit monitoring to the affected individuals whose social security numbers may have been exposed. OCR obtained assurances that the CE implemented the corrective actions listed above.