ScortonAI/Cyber-Security-Breaches huggingface dataset:
Breach report: Clara Maass Medical Center (NJ)
Type of breach: Theft
Location of breached information: Other Portable Electronic Device, Other
Date of breach: 6/24/2011
Individuals affected: 8795
Business associate involved: Med Assets
An unencrypted hard drive containing the electronic protected health information (ePHI) of 8,795 individuals was stolen from an employee of the covered entity's (CE) business associate (BA), MedAssets.  The ePHI included names, dates of birth, social security number, account numbers, medical record numbers, charges incurred, amounts paid, admission and discharge dates, and information regarding health insurance and eligibility for applicable governmental benefit programs.  Upon discovery of the breach, the CE, Clara Maass Medical Center, filed a police report, provided breach notification to HHS, the media, and affected individuals, and posted substitute notification on its website.  As a result of OCR's investigation, the BA retrained the employee, instructed all employees to stop using any type of external storage device that contains ePHI, and recalled and destroyed all unencrypted external hard drives that contained ePHI.  In addition, the BA improved technical safeguards by encrypting external hard drives and installing a new software system that monitors, controls and encrypts data leaving the BA's computers.  The BA also hired an IT security analyst to supplement its security program.  The breach incident involved a BA and occurred prior to the September 23, 2013, compliance date.  OCR verified that the CE had a proper BA agreement in place that restricted the BA's use and disclosure of PHI and required the BA to safeguard all PHI.
Breach report: Newark Beth Israel Medical Center (NJ)
Type of breach: Theft
Location of breached information: Other Portable Electronic Device, Other
Date of breach: 6/24/2011
Individuals affected: 15015
Business associate involved: MedAssets
An unencrypted hard drive containing the electronic protected health information (ePHI) of 15,015 individuals was stolen from an employee of the covered entity's (CE) business associate (BA), MedAssets.  The ePHI included names, dates of birth, social security number, account numbers, medical record numbers, charges incurred, amounts paid, admission and discharge dates, and information regarding health insurance and eligibility for applicable governmental benefit programs.  Upon discovery of the breach, the CE, Newark Beth Israel Medical Center, filed a police report, provided breach notification to HHS, the media, and affected individuals, and posted substitute notification on its website.  As a result of OCR's investigation, the BA retrained the employee, instructed all employees to stop using any type of external storage device that contains ePHI, and recalled and destroyed all unencrypted external hard drives that contained ePHI.  In addition, the BA improved technical safeguards by encrypting external hard drives and installing a new software system that monitors, controls and encrypts data leaving the BA's computers.  The BA also hired an IT security analyst to supplement its security program.  The breach incident involved a BA and occurred prior to the September 23, 2013, compliance date.  OCR verified that the CE had a proper BA agreement in place that restricted the BA's use and disclosure of PHI and required the BA to safeguard all PHI.
Breach report: Saint Barnabas Medical Center (NJ)
Type of breach: Theft
Location of breached information: Other Portable Electronic Device, Other
Date of breach: 6/24/2011
Individuals affected: 6179
Business associate involved: MedAssets
An unencrypted hard drive containing the electronic protected health information (ePHI) of 6,179 individuals was stolen from an employee of the covered entity's (CE) business associate (BA), MedAssets.  The ePHI included names, dates of birth, social security number, account numbers, medical record numbers, charges incurred, amounts paid, admission and discharge dates, and information regarding health insurance and eligibility for applicable governmental benefit programs.  Upon discovery of the breach, the CE, Saint Barnabas Medical Center, filed a police report, provided breach notification to HHS, the media, and affected individuals, and posted substitute notification on its website.  As a result of OCR's investigation, the BA retrained the employee, instructed all employees to stop using any type of external storage device that contains ePHI, and recalled and destroyed all unencrypted external hard drives that contained ePHI.  In addition, the BA improved technical safeguards by encrypting external hard drives and installing a new software system that monitors, controls and encrypts data leaving the BA's computers.  The BA also hired an IT security analyst to supplement its security program.  The breach incident involved a BA and occurred prior to the September 23, 2013, compliance date.  OCR verified that the CE had a proper BA agreement in place that restricted the BA's use and disclosure of PHI and required the BA to safeguard all PHI.
Breach report: Washington State Department of Social and Health Services (WA)
Type of breach: Unauthorized Access/Disclosure
Location of breached information: Paper
Date of breach: 7/1/2011
Individuals affected: 3950
Breach report: St. Francis Hospital (DE)
Type of breach: Loss
Location of breached information: Other Portable Electronic Device, Other
Date of breach: 6/1/2011
Individuals affected: 948
Breach report: Reznick Group, P.C. (MD)
Type of breach: Hacking/IT Incident
Location of breached information: Network Server
Date of breach: 5/9/2011
Individuals affected: 2459
Business associate involved: Assure Care Risk Management
Breach report: The Neurological Institute of Savannah & Center for Spine (GA)
Type of breach: Theft
Location of breached information: Other Portable Electronic Device, Other
Date of breach: 7/2/2011
Individuals affected: 63425
Breach report: Kimball Medical Center (NJ)
Type of breach: Theft
Location of breached information: Other Portable Electronic Device, Other
Date of breach: 6/24/2011
Individuals affected: 6785
Business associate involved: MedAssets
An unencrypted hard drive containing the electronic protected health information (ePHI) of 6,785 individuals was stolen from an employee of the covered entity's (CE) business associate (BA), MedAssets.  The ePHI included names, dates of birth, social security number, account numbers, medical record numbers, charges incurred, amounts paid, admission and discharge dates, and information regarding health insurance and eligibility for applicable governmental benefit programs.  Upon discovery of the breach, the CE, Kimball Medical Center, filed a police report, provided breach notification to HHS, the media, and affected individuals, and posted substitute notification on its website.  As a result of OCR's investigation, the BA retrained the employee, instructed all employees to stop using any type of external storage device that contains ePHI, and recalled and destroyed all unencrypted external hard drives that contained ePHI.  In addition, the BA improved technical safeguards by encrypting external hard drives and installing a new software system that monitors, controls and encrypts data leaving the BA's computers.  The BA also hired an IT security analyst to supplement its security program.  The breach incident involved a BA and occurred prior to the September 23, 2013, compliance date.  OCR verified that the CE had a proper BA agreement in place that restricted the BA's use and disclosure of PHI and required the BA to safeguard all PHI.
Breach report: Community Medical Center (NJ)
Type of breach: Theft
Location of breached information: Other Portable Electronic Device, Other
Date of breach: 6/24/2011
Individuals affected: 6950
Business associate involved: MedAssets
An unencrypted hard drive containing the electronic protected health information (ePHI) of 6,950 individuals was stolen from an employee of the covered entity's (CE) business associate (BA), MedAssets.  The ePHI included names, dates of birth, social security number, account numbers, medical record numbers, charges incurred, amounts paid, admission and discharge dates, and information regarding health insurance and eligibility for applicable governmental benefit programs.  Upon discovery of the breach, the CE, Community Medical Center, filed a police report, provided breach notification to HHS, the media, and affected individuals, and posted substitute notification on its website.  As a result of OCR's investigation, the BA retrained the employee, instructed all employees to stop using any type of external storage device that contains ePHI, and recalled and destroyed all unencrypted external hard drives that contained ePHI.  In addition, the BA improved technical safeguards by encrypting external hard drives and installing a new software system that monitors, controls and encrypts data leaving the BA's computers.  The BA also hired an IT security analyst to supplement its security program.  The breach incident involved a BA and occurred prior to the September 23, 2013, compliance date.  OCR verified that the CE had a proper BA agreement in place that restricted the BA's use and disclosure of PHI and required the BA to safeguard all PHI.
Breach report: American Health Medicare  (PR)
Type of breach: Theft
Location of breached information: Other
Date of breach: 6/1/2011
Individuals affected: 5848
Business associate involved: Accuprint 
The covered entity's (CE) business associate (BA) erroneously sent explanation of benefits letters (EOBs) containing the protected health information (PHI) of 5,848 individuals to other individuals.  The PHI included names, addresses, current procedural terminology codes (CPT), explanations of CPT codes, providers' names, and dates of service.  Upon discovery of the breach, the CE provided notice to the individuals affected by the breach but did not notify the media.  As a result of OCR's investigation, OCR provided technical assistance regarding the requirements of the Breach Notification Rule to the CE and the CE published a media notice.  In addition, the CE developed policies and procedures requiring quality control checks on the BA.  In addition, the BA adopted a new software system that validates the contents of the EOBs prior to mailing.  The breach incident involved a BA and occurred prior to the September 23, 2013, compliance date.  OCR verified that the CE had a proper BA agreement in place that restricted the BA's use of PHI and required the BA to safeguard all PHI.
Breach report: Texas Health Presbtyerian Hospital Flower Mound (TX)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 6/21/2011
Individuals affected: 10345
Business associate involved: Texas Health Partners
Breach report: Capron Rescue Squad District (IL)
Type of breach: Unauthorized Access/Disclosure
Location of breached information: Laptop
Date of breach: 2/5/2011
Individuals affected: 815
Breach report: Cook County Health & Hospitals System (IL)
Type of breach: Theft
Location of breached information: Other Portable Electronic Device, Other
Date of breach: 6/24/2011
Individuals affected: 32008
Business associate involved: MedAssets
Breach report: Lexington VAMC (KY)
Type of breach: Theft
Location of breached information: Laptop, Other Portable Electronic Device, Paper
Date of breach: 5/23/2011
Individuals affected: 1432
The covered entity's (CE) workforce member impermissibly stored the protected health information (PHI) of 1,432 individuals in a personal computer and other portable electronic media in order to conduct research. The PHI included social security numbers, names, initials, ages, and diagnoses.  Additional PHI was found in the workforce member's residence.  The CE provided breach notification to a total of 1,890 affected individuals and HHS.  Following the breach, the responsible workforce member is no longer employed by the CE.



OCR opened a compliance review of VA Medical Centers and is consolidating the investigation of this incident into the compliance review.
Breach report: Dr. Victoria Falcone, Falcone Cosmetic Services, PC, Falcone Cosmetic Services of NJ, PC (PA)
Type of breach: Theft, Unauthorized Access/Disclosure
Location of breached information: Laptop, Desktop Computer, Network Server, E-mail, Other Portable Electronic Device, Other, Electronic Medical Record, Paper
Date of breach: 8/14/2011
Individuals affected: 3000
Business associate involved: SpaMed Solutions, LLC, Edward McMenamin President,
Breach report: HEALTH RESEARCH INSTITUTE, INC., PFEIFFER TREATMENT CENTER (IL)
Type of breach: Theft
Location of breached information: Desktop Computer, Network Server
Date of breach: 7/1/2011
Individuals affected: 2000
Breach report: Stanford Hospital & Clinics (CA)
Type of breach: Unauthorized Access/Disclosure
Location of breached information: Other
Date of breach: 9/9/2010
Individuals affected: 19651
Business associate involved: Multi-Speciality Collection Services, LLC
Breach report: Muir Orthopaedic Specialists, A Medical Group Inc. (CA)
Type of breach: Theft
Location of breached information: Paper
Date of breach: 7/27/2011
Individuals affected: 1800
Breach report: NEA Baptist Clinic (AR)
Type of breach: Hacking/IT Incident
Location of breached information: Network Server
Date of breach: 7/12/2011
Individuals affected: 3116
Breach report: Jonathan Noel MD (IN)
Type of breach: Theft
Location of breached information: Other Portable Electronic Device, Other
Date of breach: 7/13/2011
Individuals affected: 2059
Breach report: Texas Health and Human Services Commission (TX)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 3/10/2011
Individuals affected: 1696
An unencrypted laptop was stolen from an employee's vehicle.  The laptop contained the ePHI of 1,696 patients.  The information at issue included patient names, dates of birth, gender, Medicaid identification numbers, procedure codes and diagnosis. Following discovery of the breach, the CE notified affected patients and notified the media. Following the breach, the CE confirmed encryption of laptops per CE's policy and sanctioned three involved employees.
Breach report: University of Wisconsin Oshkosh (WI)
Type of breach: Hacking/IT Incident
Location of breached information: Desktop Computer
Date of breach: 7/18/2011
Individuals affected: 3000
Business associate involved: Living Healthy Community Clinic
Breach report: Centro de Ortodoncia Inc. (PR)
Type of breach: Theft
Location of breached information: Paper
Date of breach: 5/6/2010
Individuals affected: 2000
OCR opened an investigation of the covered entity (CE), Dr. Pedro Valentin, after it reported boxes containing the protected health information (PHI) of 2,000 individuals were moved from the CE's office.  The PHI included names, account numbers, responsible party in charge of account, and method of payment.  OCR's investigation revealed that the individual who removed the PHI was the CE's wife and business partner.  The CE advised OCR that he knew his wife/partner was removing the boxes for the purpose of ascertaining the amount of monies the CE was receiving and that he is in the process of dissolving the partnership.  OCR concluded that the actions alleged in the breach report did not amount to a breach.
Breach report: John T. Melvin, M.D.& Associates (TX)
Type of breach: Theft
Location of breached information: Paper
Date of breach: 8/9/2011
Individuals affected: 2541
Breach report: Diversified Resources, Inc. (GA)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 8/11/2011
Individuals affected: 863
Breach report: VA Gulf Coast Veterans Health Care System (MS)
Type of breach: Theft
Location of breached information: Paper
Date of breach: 7/21/2011
Individuals affected: 1797
The covered entity (CE), U.S. Department of Veterans Affairs (VA), Gulf Coast Veterans Health Care System, Biloxi Veterans Affairs Medical Center (Biloxi VAMC) reported that the office of an employee was vandalized.  Paper files were found on the office floor, and the protected health information (PHI) of approximately 1,814 individuals was compromised.  The PHI included full names, social security numbers, dates of birth, and medical diagnoses.  The CE provided breach notification to HHS, the media and affected individuals.  Following the breach, VA police at the facility reviewed procedures and continued foot patrols to ensure office doors are locked during non-business hours.  The CE provided additional training to workforce members of the affected department on its physical security policies and procedures to improve safeguards for PHI.  OCR obtained assurances that the CE implemented the corrective action listed above.
Breach report: Freda J Bowman  MD PA (TX)
Type of breach: Unauthorized Access/Disclosure, Hacking/IT Incident
Location of breached information: Network Server
Date of breach: 9/20/2011
Individuals affected: 1300
Breach report: Bonney Lake Medical Center and Mythili R. Ramachandran, MD (WA)
Type of breach: Theft
Location of breached information: Laptop, Desktop Computer
Date of breach: 8/12/2011
Individuals affected: 2367
Breach report: United States Steel Corporation Plan for Active Employee Insurance Benefits and the United States Steel Corporation Plan for Retiree Insurance Benefits (PA)
Type of breach: Loss
Location of breached information: Other Portable Electronic Device, Other
Date of breach: 8/15/2011
Individuals affected: 4000
Business associate involved: Benefits Administration Services, Inc.
Breach report: VA Illiana Health Care System (IL)
Type of breach: Loss
Location of breached information: Paper
Date of breach: 7/14/2011
Individuals affected: 518
Breach report: Health Texas Provider Network (TX)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 7/27/2011
Individuals affected: 1259
Breach report: Blue Cross of Northeastern Pennsylvania (PA)
Type of breach: Theft, Unauthorized Access/Disclosure
Location of breached information: Laptop, Paper
Date of breach: 9/9/2011
Individuals affected: 507
Business associate involved: AllOne Health Management Solutions, Inc.
Breach report: NYU Hospital for Joint Diseases Inventory Management Department (NY)
Type of breach: Theft
Location of breached information: Paper
Date of breach: 6/23/2011
Individuals affected: 2600
A box containing 2,600 paper records of tissue implants used in surgeries was discarded by a waste disposal contractor of the covered entity (CE), NYU Hospital for Joint Diseases Inventory Management Department, when the box was not property secured.  The box contained the protected health information (PHI) of 2,239 individuals and included names, dates of birth, dates of surgery, surgeon names, procedures, and types and serial numbers of the tissues used in the surgeries.  Upon discovery of the breach, the CE contacted the waste disposal contractor and determined that the documents were discarded and buried in a landfill out of state.  The CE provided breach notification to HHS, the media, and affected individuals, and posted substitute notice on its website.  As a result of OCR's investigation, the CE improved safeguards by storing all tissue records in a locked cabinet and requiring management to store the keys.  In addition, the CE counseled the employees involved in the incident and retrained all staff on its policies and procedures for safeguarding PHI.  The CE also implemented a plan to conduct reviews of HIPAA compliance, including both physical access and physical security risks.
Breach report: WAYNE HIGHLANDS SCHOOL DISTRICT (PA)
Type of breach: Theft, Unauthorized Access/Disclosure
Location of breached information: Paper
Date of breach: 9/9/2011
Individuals affected: 579
Business associate involved: FIRST PRIORITY LIFE INSURANCE COMPANY
Breach report: Summit Medical Group, PLLC (TN)
Type of breach: Theft
Location of breached information: Paper
Date of breach: 9/4/2011
Individuals affected: 731
Breach report: MAPFRE Life (PR)
Type of breach: Theft
Location of breached information: Other
Date of breach: 8/5/2011
Individuals affected: 2209
Breach report: American Continental Insurance Company (TN)
Type of breach: Theft
Location of breached information: Other Portable Electronic Device, Other
Date of breach: 7/28/2011
Individuals affected: 690
Business associate involved: Futurity First Insurance Group
Breach report: United of Omaha Life Insurance Company (NE)
Type of breach: Loss
Location of breached information: Other Portable Electronic Device, Other
Date of breach: 7/28/2011
Individuals affected: 1631
Business associate involved: Futurity First Insurance Group
Breach report: Mutual of Omaha Insurance Company (NE)
Type of breach: Theft
Location of breached information: Other Portable Electronic Device, Other
Date of breach: 7/28/2011
Individuals affected: 705
Business associate involved: Futurity First Insurance Group
Breach report: Henry Ford Health System (MI)
Type of breach: Theft
Location of breached information: Desktop Computer
Date of breach: 8/8/2011
Individuals affected: 520
Breach report: Indiana University (IN)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 8/16/2011
Individuals affected: 3266
Breach report: Adult & Pediatric Dermatology, PC (MA)
Type of breach: Theft
Location of breached information: Other Portable Electronic Device, Other
Date of breach: 9/14/2011
Individuals affected: 2200
Breach report: The Nemours Foundation (FL)
Type of breach: Loss
Location of breached information: Other
Date of breach: 8/10/2011
Individuals affected: 1055489
Breach report: California Industrial Medicine, Inc. (CA)
Type of breach: Theft, Unauthorized Access/Disclosure
Location of breached information: Paper
Date of breach: 9/28/2011
Individuals affected: 700
Business associate involved: Thomas J O'Laughlin, MD
Breach report: InStep Foot Clinic, P.A. (MN)
Type of breach: Theft
Location of breached information: Laptop, Electronic Medical Record
Date of breach: 8/28/2011
Individuals affected: 2600
Breach report: North Memorial (MN)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 7/25/2011
Individuals affected: 6697
Business associate involved: Accretive Health, Inc
Breach report: Lahey Clinic Hospital, Inc. (MA)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 8/12/2011
Individuals affected: 599
Breach report: UnitedHealth Group health plan single affiliated covered entity (MN)
Type of breach: Theft
Location of breached information: Other
Date of breach: 7/28/2011
Individuals affected: 3994
Business associate involved: Futurity First Insurance Group
Breach report: Good Samaritan Hospital (MD)
Type of breach: Theft
Location of breached information: Paper
Date of breach: 9/9/2011
Individuals affected: 1500
Breach report: Amerigroup Community Care of New Mexico, Inc (NM)
Type of breach: Theft
Location of breached information: Paper
Date of breach: 7/15/2011
Individuals affected: 1537
Breach report: Florida Hospital (FL)
Type of breach: Unauthorized Access/Disclosure
Location of breached information: Electronic Medical Record
Date of breach: 8/10/2011
Individuals affected: 12784
Breach report: Thomas Jefferson University Hospitals, Inc. (PA)
Type of breach: Theft
Location of breached information: Other
Date of breach: 9/6/2011
Individuals affected: 3150
Breach report: Lankenau Medical Center (PA)
Type of breach: Theft
Location of breached information: Other
Date of breach: 9/6/2011
Individuals affected: 500
Breach report: Spectrum Health Ssytems, Inc.   (MA)
Type of breach: Theft
Location of breached information: Desktop Computer
Date of breach: 8/24/2011
Individuals affected: 14750
Breach report: Conway Regional Medical Center (AR)
Type of breach: Loss
Location of breached information: Other
Date of breach: 8/24/2011
Individuals affected: 1472
Breach report: Concordia Plan Services (MO)
Type of breach: Loss
Location of breached information: Other
Date of breach: 5/10/2011
Individuals affected: 7059
Business associate involved: HITS Scanning Solutions, Inc.