HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of July 20, 2013.
- Organization as reported
- The Brookdale Hospital and Medical Center, NY
- Entity type as reported
- Healthcare Provider
- Category as reported
Loss
- Location of information as reported
- Other Portable Electronic Device
- Submission date
- July 20, 2013
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15359, row:6498)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE), Brookdale Hospital and Medical Center, reported a breach when a staff pharmacist lost an unencrypted USB external hard drive that contained the electronic protected health information (ePHI) of 2,700 patients. The ePHI included addresses, zip codes, dates of birth, diagnosis codes, and medical record numbers. The CE provided breach notification to HHS, the affected individuals, and the media. Following the loss, the CE disabled all USB ports in all of its computers to prevent any staff members from using USB external hard drives to store data from its electronic records system, established a policy on obtaining an encrypted USB external hard drive from its IT department, and retrained its pharmacist staff. As a result of OCR’s investigation and technical assistance, the CE is expected to review and revise its policies and procedures and training materials regarding reporting breach incidents and the usage of mobile and portable devices by its staff members. Additionally, OCR stated the expectation that the CE will perform a thorough and accurate enterprise wide risk analysis and establish a Risk Management Plan that addresses the threats and vulnerabilities identified by the risk analysis.