ScortonAI/Cyber-Security-Breaches huggingface dataset:
Breach report: Fort Worth Allergy and Asthma Associates (TX)
Type of breach: Theft
Location of breached information: Network Server
Date of breach: 6/29/2010
Individuals affected: 25000
Breach report: Beauty Dental, Inc. (IL)
Type of breach: Theft, Loss
Location of breached information: Paper
Date of breach: 6/5/2010
Individuals affected: 657
Following the breach, the covered entity notified its clients by letter of the incident, submitted a press release that outlined the circumstances of the breach to the Chicago Tribune and the Chicago Sun Times, required the individual who allegedly stole the documents to return all physical patient PHI in her possession and sign a statement swearing that she no longer possessed any patient documents, would not use or disclose the PHI in any manner and would erase an excel spreadsheet she had in her possession, installed a new security system for the office that requires the input of a code specific to each employee, and implemented new technical safeguards that limited employee access to ePHI according to the employee's position and rank.
Breach report: Walsh Pharmacy (MA)
Type of breach: Other
Location of breached information: Other Portable Electronic Device, Other
Date of breach: 6/3/2010
Individuals affected: 11440
Business associate involved: McKesson Pharmacy Systems LLC
Breach report: Jewish Hospital (KY)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 7/16/2010
Individuals affected: 2089
Breach report: St. John's Mercy Medical Group (MO)
Type of breach: Improper Disposal
Location of breached information: Paper
Date of breach: 6/7/2010
Individuals affected: 1907
Covered entity improperly disposed of patients' Protected Health Information (PHI), by placing the PHI in a dumpster outside of a doctor's office. The PHI involved in the breach included demographic, financial, clinical, and other medical information. Following the breach, the covered entity notified all affected individuals of the breach, posted a notice about the incident on its website; attempted to retrieve and track all of the medical records that were inappropriately disposed of; offered all affected individuals identity theft protection; obtained a formal apology from and assumed direct office operations management of the physician involved; re-educated its workforce to reinforce policies relating to appropriate medical record protection and disposal requirements.
Breach report: Thomas Jefferson University Hospitals, Inc. (PA)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 6/14/2010
Individuals affected: 21000
Breach report: UNCG Speech and Hearing Center (NC)
Type of breach: Hacking/IT Incident
Location of breached information: Desktop Computer
Date of breach: 1/1/1997
Individuals affected: 2300
Breach report: Idaho Power Group Health Plan (ID)
Type of breach: Loss
Location of breached information: Other
Date of breach: 3/29/2010
Individuals affected: 5500
Business associate involved: Mercer Health & Benefits
Idaho Power Group Health Plan's business associate, Mercer Health and Benefits, lost a backup tape as it was being sent via FEDEX from Boise to Seattle. The backup tape contained information of about 375,000 individuals that Mercer serviced. The total affected at Idaho Power was about 5,500 current and former employees and their dependents. The protected health information involved included names, addresses, dates of birth, and social security numbers. Although Mercer concluded that the lost tape was configured so that even a sophisticated user would be unlikely to be able to access the data within, both Mercer and Idaho Power notified all possible affected individuals and offered free credit protection services. To prevent a similar breach from occurring in the future, Mercer now stores backup tapes through a third party vendor who offers secure transport services. Mercer's Boise office now encrypts backup tapes. Following the incident, Idaho Power renegotiated its contract with Mercer and continues to evaluate its business relationship with Mercer.
Breach report: Loma Linda University School of Dentistry (CA)
Type of breach: Theft
Location of breached information: Desktop Computer
Date of breach: 6/13/2010
Individuals affected: 10100
Breach report: Ward A. Morris, DDS (WA)
Type of breach: Theft
Location of breached information: Desktop Computer
Date of breach: 7/16/2010
Individuals affected: 2698
Breach report: Chattanooga Family Practice Associates, P.C. (TN)
Type of breach: Loss
Location of breached information: Other Portable Electronic Device, Other
Date of breach: 7/15/2010
Individuals affected: 1711
Breach report: Yale University (CT)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 7/28/2010
Individuals affected: 1000
Breach report: University of Kentucky (KY)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 6/18/2010
Individuals affected: 2027
Breach report: Cook County Health & Hospitals System (IL)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 5/30/2010
Individuals affected: 7081
An employee's laptop was stolen out of a locked office; evidence shows that the laptop was password protected but not encrypted.  The laptop contained the protected health information (PHI) of approximately 7,000 individuals.  The PHI stored on the laptop included names, dates of birth, Social Security numbers, internal encounter numbers, and other administrative codes.  Following the breach, the covered entity notified those individuals reasonably believed to have been affected by the breach, placed notice on its website and with a local news center; established stringent computer security guidelines, and retrained its staff in the new requirements with the intention of preventing a similar event from occurring again.
Breach report: Eastmoreland Surgical Clinic, William Graham, DO (OR)
Type of breach: Theft
Location of breached information: Laptop, Desktop Computer, Other Portable Electronic Device, Other
Date of breach: 7/5/2010
Individuals affected: 4328
Three desktop computers, one laptop computer, and a backup drive, containing the electronic protected health information (EPHI) of 4,328 individuals, were stolen on July 5, 2010.  The EPHI involved in the breach included names, addresses, phone numbers, dates of birth, Social Security numbers, reason for visits, and insurance information.  Following the breach, the covered entity implemented backup and whole disk encryption on electronic information systems that maintain EPHI and improved their physical safeguards.  Additionally, OCR's investigation resulted in the covered entity improving their administrative safeguards, such as password complexity requirements and data backup protocols.
Breach report: SunBridge Healthcare Corporation (NM)
Type of breach: Theft
Location of breached information: Other Portable Electronic Device, Other
Date of breach: 6/26/2010
Individuals affected: 1000
Breach report: Holyoke Medical Center (MA)
Type of breach: Improper Disposal
Location of breached information: Paper
Date of breach: 7/26/2010
Individuals affected: 24750
Business associate involved: Pioneer Valley Pathology
Breach report: Newark Beth Israel Medical Center (NJ)
Type of breach: Theft
Location of breached information: Other Portable Electronic Device, Other
Date of breach: 5/10/2010
Individuals affected: 956
Business associate involved: KPMG LLP
OCR opened an investigation of the covered entity (CE), Newark Beth Israel Medical Center, after it reported an employee of the CE's business associate (BA), KPMG LLP, lost an unencrypted USB drive that contained the electronic protected health information (ePHI) of 956 individuals.  The ePHI included names and clinical information.  Upon discovery of the breach, the CE's BA conducted a search of the area.  The CE provided breach notification to HHS, the Media and affected individuals.  As a result of OCR's investigation, the BA installed and implemented encryption software to its electronic equipment and devices.  In addition, the BA encrypted and password protected all equipment and devices that could contain the CE's data.  The BA also reprimanded and retrained the employee and retrained all employees on safeguarding ePHI.  The breach incident involved a BA and occurred prior to the September 23, 2013, compliance date.  OCR verified that the CE had a proper BA agreement in place that restricted the BA's use and disclosure of PHI and required the BA to safeguard all PHI.
Breach report: Saint Barnabas Medical Center (NJ)
Type of breach: Theft
Location of breached information: Other Portable Electronic Device
Date of breach: 5/10/2010
Individuals affected: 3630
Business associate involved: KPMG LLP
The covered entity (CE), Long Island Consultation Center, misplaced an unencrypted portable device that contained the electronic protected health information (ePHI) of 800 individuals.  The ePHI included names, dates of birth, diagnoses, and other treatment information.  Upon discovery of the breach, the CE conducted a search for the portable device.  The CE provided breach notification to HHS, the media, and affected individuals.  As a result of OCR's investigation, the CE improved physical security.   The CE also developed and implemented a policy and procedure prohibiting use of portable media for storing ePHI and trained staff on its new policy.
Breach report: NYU School of Medicine--Aging and Dementia Clinical Research Center  (NY)
Type of breach: Loss
Location of breached information: Other Portable Electronic Device, Other
Date of breach: 4/3/2010
Individuals affected: 1200
Breach report: University of Rochester Medical Center and Affiliates (NY)
Type of breach: Loss
Location of breached information: Other Portable Electronic Device
Date of breach: 8/2/2010
Individuals affected: 857
Breach report: State of Delaware Health Plan (DE)
Type of breach: Other
Location of breached information: Network Server
Date of breach: 8/16/2010
Individuals affected: 22642
Business associate involved: Aon Consulting
The business associate prepared a document as part of a request for proposal for the covered entity's vision benefit program which mistakenly included protected health information of 22,642 individuals.  The document was posted online for five days.  The protected health information involved in the breach included social security numbers, dates of birth, gender, zip codes, and vision plan enrollment information.  In response to this incident, the covered entity implemented additional safeguards to prevent this type of impermissible disclosure of protected health information.  In particular, the covered entity will now require several layers of review before allowing public disclosure of documents prepared by the business associate.  The covered entity also took steps to enforce the requirements of its business associate agreement with Aon Consulting.  Aon will provide affected individuals with free credit monitoring, fraud resolution resources, and identity theft insurance.  Additionally, the business associate has provided assurances to the covered entity that it has taken steps to prevent this type of impermissible disclosure in the future.
Breach report: Curtis R. Bryan, M.D. (VA)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 7/12/2010
Individuals affected: 2739
Breach report: Mayo Clinic (MN)
Type of breach: Unauthorized Access/Disclosure
Location of breached information: Electronic Medical Record
Date of breach: 7/15/2009
Individuals affected: 1740
Breach report: LabCorp Patient Service Center (NV)
Type of breach: Theft
Location of breached information: Paper
Date of breach: 8/2/2010
Individuals affected: 507
Breach report: The Kent Center  (RI)
Type of breach: Theft
Location of breached information: Paper
Date of breach: 7/13/2010
Individuals affected: 1361
Breach report: Pediatric and Adult Allergy, PC (IA)
Type of breach: Loss
Location of breached information: Other Portable Electronic Device
Date of breach: 7/11/2010
Individuals affected: 19222
Breach report: Ault Chiropractic Center (IN)
Type of breach: Theft
Location of breached information: Laptop, Desktop Computer
Date of breach: 9/15/2010
Individuals affected: 2000
Breach report: County of Los Angeles (CA)
Type of breach: Theft
Location of breached information: Paper
Date of breach: 7/29/2010
Individuals affected: 33000
Breach report: Matthew H. Conrad, M.D., P.A. (KS)
Type of breach: Theft
Location of breached information: Laptop, Paper
Date of breach: 8/20/2010
Individuals affected: 1200
Breach report: UnitedHealth Group health plan single affiliated covered entity (MN)
Type of breach: Other
Location of breached information: Paper
Date of breach: 7/8/2010
Individuals affected: 1270
Business associate involved: CareCore National
Breach report: Counseling and Psychotherapy of Throggs Neck (NY)
Type of breach: Theft
Location of breached information: Desktop Computer
Date of breach: 9/6/2010
Individuals affected: 9000
Breach report: United States Air Force (OH)
Type of breach: Improper Disposal
Location of breached information: Paper
Date of breach: 7/29/2010
Individuals affected: 2123
Breach report: State of Alaska, Department of Health and Social Services (AK)
Type of breach: Theft
Location of breached information: Other Portable Electronic Device, Other
Date of breach: 9/7/2010
Individuals affected: 2000
Business associate involved: Alaskan AIDS Assistance Association
Breach report: St. Vincent Hospital and Health Care Center, Inc. (IN)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 7/25/2010
Individuals affected: 1199
Breach report: Milford Regional Medical Center (MA)
Type of breach: Improper Disposal
Location of breached information: Paper
Date of breach: 7/26/2010
Individuals affected: 20000
Breach report: Alliance HealthCare Services, Inc. (CA)
Type of breach: Theft
Location of breached information: Other Portable Electronic Device, Other
Date of breach: 7/31/2010
Individuals affected: 1474
Business associate involved: Oroville Hospital
The covered entity (CE) filed a breach report with OCR after two USB storage devices containing electronic protected health information (ePHI) of 1,474 individuals were lost.  The ePHI included names, dates of birth, and treatment information.  Upon discovery of the breach, the CE notified individuals, OCR and the media.  Additionally, the CE initiated an encryption project to encrypt emails, external hard drives, and related media.  Following OCR's investigation, the CE filed a police report, updated its policies and procedures in an effort to better safeguard ePHI, and encrypted USB devices.
Breach report: Alliance HealthCare Services, Inc. (CA)
Type of breach: Theft
Location of breached information: Other Portable Electronic Device, Other
Date of breach: 8/5/2010
Individuals affected: 1474
Business associate involved: Eden Medical Center
The covered entity (CE) lost two portable electronic storage devices containing the electronic protected health information (ePHI) of 1,474 individuals.  The ePHI included patients' names, dates of birth, and treatment information.  Upon discovery of the breach, the covered entity (CE) notified individuals, HHS, and the media.  Additionally, the CE initiated a project to encrypt emails, external hard drives, and related electronic media.  Following OCR's investigation, the CE filed a police report, updated its policies and procedures in order to better safeguard patients' ePHI, and encrypted portable electronic computer devices.
Breach report: St. James Hospital and Health Centers (IL)
Type of breach: Improper Disposal
Location of breached information: Paper
Date of breach: 8/10/2010
Individuals affected: 967
Breach report: University of Oklahoma - Tulsa, Neurology Clinic (OK)
Type of breach: Hacking/IT Incident
Location of breached information: Desktop Computer
Date of breach: 7/28/2010
Individuals affected: 19200
Breach report: LORENZO BROWN, MD INC. (CA)
Type of breach: Theft
Location of breached information: Desktop Computer
Date of breach: 8/17/2010
Individuals affected: 928
Breach report: Milton Pathology Associates, P.C. (MA)
Type of breach: Improper Disposal
Location of breached information: Paper
Date of breach: 7/26/2010
Individuals affected: 11000
Business associate involved: Joseph A. Gagnon d/b/a Goldthwait Associates
Breach report: WESTMED Medical Group (NY)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 8/17/2010
Individuals affected: 578
An unencrypted laptop computer that contained the electronic protected health information (ePHI) of 578 individuals was stolen from the covered entity (CE), WestMed Medical Group.  The ePHI included names, dates of birth and test results.  Upon discovery of the breach, the CE filed a police report and provided breach notification to affected individuals, HHS and the media.  As a result of OCR's investigation, the CE improved physical security by locking all laptops during the day and storing all laptops in a locked cabinet overnight.  In addition, the CE reconfigured all laptops with strong passwords and implemented a new procedure to save data to a secure file server.  Further, the CE encrypted all laptop hard drives.  The CE also retrained staff on safeguarding ePHI.
Breach report: Debra C. Duffy, DDS (TX)
Type of breach: Theft
Location of breached information: Laptop, Network Server
Date of breach: 8/5/2010
Individuals affected: 4700
An unencrypted laptop and network server were stolen during a burglary of the office.The breach affected approximately 4700 individuals.The protected health information involved in the breach included treatment information for pediatric dental patients and social security numbers, insurance identification numbers and driver's license numbers. Following the discovery of the breach, the CE relocated the practice servers, secured the laptops and installed steel doors at the front entrance of the facility. Additionally, the CE notified the affected individuals and local media and retrained staff.
Breach report: Cumberland Gastroenterology, P.S.C. (KY)
Type of breach: Theft
Location of breached information: Paper
Date of breach: 9/18/2010
Individuals affected: 2200
Breach report: Johns Hopkins University Applied Physics Laboratory (JHU/APL) Medical and Dental Insurance Plan (MD)
Type of breach: Other
Location of breached information: Other
Date of breach: 6/15/2010
Individuals affected: 692
Protected health information was attached to an email addressed to 85 employees by a benefits staff member. Within 5 days, all recipients were notified, and the email was deleted.  Approximately 692 individuals were affected by this breach.  The email included names, dates of birth, social security numbers, and marital and disability status.  To prevent a similar breach from happening in the future, the covered entity instituted a policy to encrypt emails containing protected health information before it is sent out from the benefits department.  Following OCR's investigation, the covered entity updated its policies and procedures establishing a new business process to require that all emails sent by the benefits office to 5 or more staff members that includes an attachment be reviewed by another team member to ensure the proper document is attached and took personnel action with the responsible employee. Further, the benefits office will use an encryption specialist to train all benefits office staff in the proper methods of encryption, explore future capability of automated flagging of any electronic communications sent by benefits office staff containing potentially sensitive data such as 9-digit numbers, and obtain additional HIPAA training.
Breach report: LoneStar Audiology Group (TX)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 8/11/2010
Individuals affected: 585
A laptop was stolen from a workforce member's home. Approximately 585 individuals were affected.  The PHI included addresses, dates of birth, diagnosis and conditions, medications and other treatment information. Following the breach, the covered entity encrypted all its laptops. After the initiation of OCR's investigation, the encryption of the laptops was completed.
Breach report: Utah Department of Health (UT)
Type of breach: Other
Location of breached information: Desktop Computer, Paper
Date of breach: 3/1/2010
Individuals affected: 1298
Business associate involved: Utah Department of Workforce Services
Breach report: SW Seattle Orthopaedic and Sports Medicine (WA)
Type of breach: Hacking/IT Incident
Location of breached information: Network Server
Date of breach: 9/4/2010
Individuals affected: 9493
A database web server, containing the electronic protected health information (EPHI) of 9,493 individuals, was breached by an unknown, external person(s) for use as a game server.  Although there was no indication of access to EPHI, the EPHI on the database web server included names, dates of birth, types of x-rays, and dates of x-rays.  Following the breach, the covered entity relocated two servers to its more secure primary data center and removed the Internet access line that resulted in the breach.  Additionally, OCR's investigation resulted in the covered entity improving their administrative safeguards, such as incident response and reporting.
Breach report: University of Arkansas for Medical Sciences (AR)
Type of breach: Theft
Location of breached information: Other Portable Electronic Device, Other
Date of breach: 10/12/2010
Individuals affected: 1000
Breach report: BlueCross BlueShield of Tennessee, Inc. (TN)
Type of breach: Theft
Location of breached information: Other
Date of breach: 10/2/2009
Individuals affected: 1023209
Breach report: Northridge Hospital Medical Center (CA)
Type of breach: Loss
Location of breached information: Paper
Date of breach: 10/16/2010
Individuals affected: 716
Breach report: Puerto Rico Department of Health (PR)
Type of breach: Unauthorized Access/Disclosure, Hacking/IT Incident
Location of breached information: Network Server
Date of breach: 10/3/2008
Individuals affected: 475000
Business associate involved: Triple-S Management, Corp.; Triple-S Salud, Inc.;
Breach report: Aetna, Inc. (CT)
Type of breach: Unauthorized Access/Disclosure
Location of breached information: Network Server
Date of breach: 9/9/2010
Individuals affected: 2345
Aetna notified all possibly affected individuals of the breach, filed a breach report with OCR, commenced an investigation to identify and correct the root cause of the issue; the coding changes that were causing the breach were removed from IPS via Aetna's emergency Change Management procedures to prevent any further exposure while the problem was analyzed; once the specific code that conflicted with its proxy server settings was identified as the root cause of the breach, it was removed. Also, in an effort to mitigate any harm as a result of the breach, Aetna offered all affected individuals one year of free credit monitoring, and the notification letters included a toll-free number which was established specifically to answer questions related to this incident.
Breach report: Sta-home Health & Hospice (MS)
Type of breach: Theft
Location of breached information: Desktop Computer
Date of breach: 9/16/2010
Individuals affected: 1104
Breach report: Puerto Rico Department of Health (PR)
Type of breach: Unauthorized Access/Disclosure
Location of breached information: Other Portable Electronic Device, Other
Date of breach: 9/3/2010
Individuals affected: 115000
Business associate involved: Medical Card System/MCS-HMO/MCS Advantage/MCS Life
Breach report: VNA of Southeastern Ct. (CT)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 9/30/2010
Individuals affected: 12000
Breach report: Prime Home Care, LLC (NE)
Type of breach: Theft
Location of breached information: Desktop Computer
Date of breach: 9/13/2010
Individuals affected: 1550