HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of June 2, 2018.
- Organization as reported
- University of Utah Health, UT
- Entity type as reported
- Healthcare Provider
- Category as reported
Theft
- Location of information as reported
- Laptop, Other Portable Electronic Device
- Submission date
- June 2, 2018
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13796, row:4935)
- Archived copy
- Held in the private archive (provenance)
A laptop computer and an external hard drive containing protected health information (PHI) were stolen from the University of Utah Health, Moran Eye Center, the covered entity (CE), on or about April 3, 2018. Together, the stolen equipment contained the PHI of 607 individuals, including their retinal scans, names, dates of birth, and medical record numbers. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE identified the thief, reported to the police, and upgraded physical security at the Center. As a result of the investigation, the Center developed a facility security plan, and the CE developed a team to inventory devices in clinical and administrative areas to find any that had been missed in prior inventories to ensure that all devices containing PHI were included in the CE’s security processes. OCR obtained assurances that the CE implemented the corrective actions noted above.