HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of April 26, 2013.
- Organization as reported
- Valley Mental Health, UT
- Entity type as reported
- Healthcare Provider
- Category as reported
Theft
- Location of information as reported
- Desktop Computer
- Submission date
- April 26, 2013
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15418, row:6557)
- Archived copy
- Held in the private archive (provenance)
On February 27, 2013, Valley Mental Health, the covered entity (CE), discovered that a computer hard drive had been stolen from one of its facilities. The computer was located in a common area and available for use by members. The hard drive contained protected health information (PHI)—members' names, diagnostic and treatment information, financial records, media release forms, members' photographs, activity sign-up sheets, and resumes—for approximately 700 individuals. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach and during OCR’s investigation, the CE posted signs reminding members that information stored on shared computers is not confidential, encrypted hard drives, and stored PHI in locked offices and locked file cabinets. OCR obtained assurances that the CE implemented the corrective actions listed above, and OCR provided the CE with technical assistance regarding its Security Rule obligations.