HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of June 18, 2010.
- Organization as reported
- University of Kentucky, KY
- Entity type as reported
- Healthcare Provider
- Category as reported
Theft
- Location of information as reported
- Laptop
- Submission date
- June 18, 2010
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 16035, row:7174)
- Archived copy
- Held in the private archive (provenance)
A laptop computer containing the protected health information (PHI) of approximately 2,027 individuals was stolen from the covered entity (CE), University of Kentucky, Department of Pediatrics. The information was part of the New Born Screening Program sent to that department by the state screening program. The types of PHI involved in the breach included demographic information, specifically, names, addresses, dates of birth, social security numbers, and other identifiers, and clinical information. As a result of OCR’s investigation the CE provided OCR with an updated status report of its encryption project that it had previously reported as one of its corrective measures. It also trained workforce members on encryption of computing devices and provided reminders to workforce members about its facility locking procedures. Additionally, the CE provided a report of its information security assessment with details of security gaps as evidence of its risk analysis, along with recommendations for remediation of the gaps identified in the assessment. The CE also improved physical safeguards. The CE provided documentation of compliance with the applicable notification provisions of the Breach Notification Rule. It also updated its accounting of disclosures policy, and drafted a new policy relating to accounting of disclosures regarding breach incidents.