HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of July 12, 2012.
- Organization as reported
- SwedishAmerican Health System, IL
- Entity type as reported
- Healthcare Provider
- Category as reported
Theft
- Location of information as reported
- Paper/Films
- Submission date
- July 12, 2012
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15603, row:6742)
- Archived copy
- Held in the private archive (provenance)
An individual misrepresented himself as an employee of a vendor contracted with the covered entity (CE) to dispose of x-ray films, obtained access to a storage area that contained films to be destroyed, and stole approximately 1,500 x-ray films from the CE. The CE strongly believes that the films were stolen due to silver content rather than patient information. The protected health information (PHI) involved in the breach included names, addresses, dates of birth, medical record numbers, account numbers and x-ray types. The CE provided breach notification to HHS and the media and posted substitute notice online. Following the breach, the CE examined its policies and procedures, established a committee to oversee PHI destruction processes, reviewed physical security on campuses, and issued email notices to all workforce members regarding vendor security. OCR reviewed the CE’s policies and procedures.