HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of July 3, 2015.
- Organization as reported
- University of Oklahoma, Department of Obstetrics and Gynecology, OK
- Entity type as reported
- Healthcare Provider
- Category as reported
Theft
- Location of information as reported
- Laptop
- Submission date
- July 3, 2015
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14763, row:5902)
- Archived copy
- Held in the private archive (provenance)
An unencrypted, password-protected laptop computer was stolen from a resident physician’s car. The laptop contained the electronic protected health information (ePHI) of approximately 7,693 individuals and included patients’ names, dates of birth, medical procedure dates, medications, lab results, admission and discharge dates, treating physicians’ names, and treatment plans. The covered entity (CE), University of Oklahoma, provided breach notification to HHS, affected individuals, and the media. It also offered identity protection services to affected individuals and posted substitute notice on its website. Following the breach, the CE retrained the resident physicians on its encryption policies and procedures and counseled and sanctioned the involved resident. As a result of OCR’s investigation, the CE developed a policy on encryption of laptops for all first-year residents. It also instituted a requirement for all first-year residents to disclose all laptops, tablets, and smartphones to be used for the CE’s business and to ensure they are encrypted by the CE’s representatives.