HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Feb. 26, 2016.
- Organization as reported
- Valley Hope Association, KS
- Entity type as reported
- Healthcare Provider
- Category as reported
Theft
- Location of information as reported
- Laptop
- Submission date
- Feb. 26, 2016
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14608, row:5747)
- Archived copy
- Held in the private archive (provenance)
On December 30, 2015, a Valley Hope Association employee's work-issued laptop computer was stolen from her vehicle. The incident affected approximately 52,076 individuals. The protected health information (PHI) stored on the laptop included names, addresses, dates of birth, phone numbers, social security numbers, medical record numbers, treatment types and locations, as well as health insurance, financial, and medication information. The employee immediately reported the incident to the local police and the covered entity (CE). The CE conducted a forensic analysis and concluded that the system had not been accessed following the theft. Following the breach, the CE terminated the computer’s access to its computer network, reset the user’s password, and verified the laptop had no open connections to other electronic systems. The CE encrypted all devices containing PHI and implemented the use of software to mask social security numbers. The CE also developed an information security and privacy committee, updated its policies and procedures manual, and trained staff on its updated policies and procedures relating to password use and development, automatic time outs on electronic devices, malicious malware, and network access rights. The CE provided breach notification to HHS, affected individuals, and the media and posted substitute notice on the home page of its website. OCR obtained assurances that the CE implemented the corrective actions listed above.