HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of Aug. 18, 2010.
- Organization as reported
- Yale University, CT
- Entity type as reported
- Healthcare Provider
- Category as reported
Theft
- Location of information as reported
- Laptop
- Submission date
- Aug. 18, 2010
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15991, row:7130)
- Archived copy
- Held in the private archive (provenance)
An unsecured laptop computer containing sensitive protected health information (PHI) involving the Ryan White Part A program, involving approximately 1,000 individuals, was stolen from an office building on Yale’s premises. The types of PHI contained on the laptop consisted of names, dates of birth, diagnoses/conditions, medications, lab results, and other treatment information. The covered entity (CE) provided breach notification to HHS, the media and affected individuals. Following the breach, the CE installed access card readers for entry to the office suite, inspected the facility’s alarm system, replaced custodial staff, and limited cleaning to office hours. The CE also accelerated the implementation of safeguards created prior to the theft, implemented mandatory encryption for all mobile devices, and created a new system to ensure all employees complete mandatory Privacy and Security Awareness training. The CE also revised several policies and procedures on ePHI security. OCR obtained assurances that the CE implemented the corrective actions listed above.