HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Oct. 9, 2015.
- Organization as reported
- The Johns Hopkins Hospital, MD
- Entity type as reported
- Healthcare Provider
- Category as reported
Theft
- Location of information as reported
- Laptop
- Submission date
- Oct. 9, 2015
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14693, row:5832)
- Archived copy
- Held in the private archive (provenance)
On October 10, 2015, the covered entity (CE), Johns Hopkins Hospital, reported that a physician’s unencrypted laptop computer storing the electronic protected health information (ePHI) of 571 individuals was stolen at an international airport with all of her belongings. The types of ePHI contained in the laptop included physicians' names, patients' names, medical record numbers, and clinical information. The CE provided breach notification to HHS, the media, affected individuals, and offered credit monitoring. The CE sanctioned the physician involved in accordance with the CE's HIPAA sanctions policy. The CE also circulated a broadcast reminder to its workforce members of their existing policy requiring all devices that contain or may contain PHI to be encrypted and password protected. OCR obtained assurances that any of the CE's portable devices that stores ePHI is required to use the CE's encryption program. Additionally, the CE submitted a copy of its most recent risk analysis and risk management program to OCR. They also provided OCR with information related to their new encryption program that would inform a user when he or she is out of compliance and send them to a website that would refer them to local IT administration. OCR obtained assurances that the CE implemented the corrective actions listed.