HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of Sept. 9, 2016.
- Organization as reported
- U.S. HealthWorks, CA
- Entity type as reported
- Healthcare Provider
- Category as reported
Theft
- Location of information as reported
- Laptop
- Submission date
- Sept. 9, 2016
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14427, row:5566)
- Archived copy
- Held in the private archive (provenance)
U.S. HealthWorks, the covered entity (CE), experienced a breach on July 18, 2016 due to the theft of a CE-issued laptop computer and a notebook containing the laptop encryption password from an employee’s automobile. The breach involved the protected health information (PHI) of 1,400 individuals and included patients names, clinical information, visit dates, and social security numbers for some patients. The CE provided breach notification to HHS, affected individuals, and the media and also provided substitute notification. Additionally, the CE offered individuals who had their social security numbers involved in the breach one year of complimentary credit monitoring and identity theft protection services. Following the breach, the CE sanctioned the employee involved in the breach and retrained all employees on information security. OCR provided the CE with technical assistance regarding the Security Rule, including risk analysis and risk management.