HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Sept. 1, 2015.
- Organization as reported
- University of California, Los Angeles Health, CA
- Entity type as reported
- Healthcare Provider
- Category as reported
Theft
- Location of information as reported
- Laptop
- Submission date
- Sept. 1, 2015
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14719, row:5858)
- Archived copy
- Held in the private archive (provenance)
The University of California, Los Angeles Health, the covered entity (CE), reported to OCR that on July 3, 2015, a password-protected, unencrypted laptop computer owned by the CE was stolen from an employee’s locked vehicle. The stolen computer contained electronic protected health information (ePHI), including the names, medical record numbers, diagnoses, conditions, and other treatment information of approximately 1,242 individuals. The CE immediately reported the incident to local law enforcement, but; the laptop was not recovered. The CE provided timely breach notification to individuals and the media and provided substitute notice. Following the breach and subsequent investigation, the CE sanctioned and re-trained the employee whose laptop was stolen for failing to comply with its HIPAA policies and procedures and implemented additional technical and administrative safeguards to ensure encryption of its laptops. OCR obtained assurances that the CE implemented the corrective actions above.