HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of Nov. 28, 2016.
- Organization as reported
- Young Adult Institute, Inc., NY
- Entity type as reported
- Healthcare Provider
- Category as reported
Theft
- Location of information as reported
- Other Portable Electronic Device
- Submission date
- Nov. 28, 2016
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14347, row:5486)
- Archived copy
- Held in the private archive (provenance)
The covered entity's (CE) former Chief Information Officer instructed a former Assistant IT Director to copy files containing the protected health information (PHI) of 913 clients onto a portable computer drive. Subsequently, the former CIO took the drive with him to his new employer after he was terminated. The types of PHI involved in the breach included names, addresses, dates of birth, social security numbers, Medicaid numbers and diagnoses The CE provided breach notification to HHS, the affected individuals, and the media. As a result of OCR’s investigation, the CE revised its procedures with respect to assigning an approval process for access to removable media. In addition, the CE conducted a risk analysis and established a risk management plan to manage and reduce the risks identified in the risk analysis, including, but not limited to, access to removable drives. As a result of OCR's investigation it is expected to implement technical security measures to guard against unauthorized access to ePHI, and review and revise its policies and procedures and training materials regarding the Security Rule. Additionally, the CE is expected to execute HIPAA-compliant business associate agreements with all existing business associates by September 1, 2017.