HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Dec. 8, 2017.
- Organization as reported
- UNC Health Care System, NC
- Entity type as reported
- Healthcare Provider
- Category as reported
Theft
- Location of information as reported
- Desktop Computer
- Submission date
- Dec. 8, 2017
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13978, row:5117)
- Archived copy
- Held in the private archive (provenance)
UNC Health Care System, the covered entity (CE), reported that a computer was stolen that contained 27,113 patients’ files of a newly acquired medical practice (Burlington Dermatology). The types of protected health information (PHI) involved in the breach included names, addresses, birthdates, phone numbers, employment information, and social security information. 3,132 of the 27,113 individuals are deceased and the CE had no contact information for the next of kin or personal representatives. The CE provided breach notification to the remaining 23,981 affected individuals, HHS, and the media, and posted substitute notice on the CE’s website. As a result of this incident, and OCR’s investigation, the CE implemented new policies and procedures to limit the intake of patient files and computer systems from newly acquired medical practices and to upgrade acquired files and computer systems to comply with the CE’s security policies. OCR obtained assurances that the CE implemented the corrective actions noted above