HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Oct. 3, 2013.
- Organization as reported
- University of California, San Francisco, CA
- Entity type as reported
- Healthcare Provider
- Category as reported
Theft
- Location of information as reported
- Laptop, Paper/Films
- Submission date
- Oct. 3, 2013
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15307, row:6446)
- Archived copy
- Held in the private archive (provenance)
On September 9, 2013, both an unencrypted personal laptop computer containing electronic protected health information (ePHI) and paper documents that contained PHI were stolen out of a workforce member’s locked car. The laptop contained unencrypted ePHI pertaining to 3,541 individuals, and the paper documents contained PHI for 31 patients. The types of PHI involved in the breach included patients’ names, addresses, dates of birth, medical record numbers, social security numbers, diagnoses, conditions, dates of service, lab results, medications, and other treatment-related PHI. The covered entity (CE), the University of California San Francisco, provided breach notification to HHS, affected individuals, and the media. Following the breach the CE retrained the workforce members on encryption, use of email on personal devices, and best practices for sharing PHI documents via email. OCR obtained assurances that the CE implemented the corrective actions noted above.