ScortonAI/Cyber-Security-Breaches huggingface dataset:
Breach report: Stone Oak Urgent Care & Family Practice (TX)
Type of breach: Theft, Loss
Location of breached information: Desktop Computer
Date of breach: 10/23/2011
Individuals affected: 6672
Business associate involved: Stone Oak Urgent Care & Family Practice
Breach report: Indiana University School of Optometry (IN)
Type of breach: Unauthorized Access/Disclosure
Location of breached information: Network Server
Date of breach: 8/12/2011
Individuals affected: 757
Breach report: Brevard Emergency Services, P.A. (FL)
Type of breach: Theft
Location of breached information: Paper
Date of breach: 8/26/2011
Individuals affected: 2200
Breach report: Georgetown University Hospital (DC)
Type of breach: Loss
Location of breached information: Other Portable Electronic Device, Other
Date of breach: 9/9/2011
Individuals affected: 1526
Breach report: Morris Heights Health Center (NY)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 8/27/2011
Individuals affected: 927
An unencrypted laptop computer containing the electronic protected health information (ePHI) of 927 individuals was stolen from the covered entity's (CE) school based health center.  The ePHI included names, dates of birth, sex, ethnicities, height, weight, body mass index data, complete physical examination information such as asthma and obesity information, health action plans, and enrollment dates.  Upon discovery of the breach, the CE filed a police report to recover the stolen laptop.  As a result of OCR's investigation, the CE purchased locks to physically secure its' school health computers to the desks where the computers are located.  In addition, the CE encrypted all portable devices' hard drives and installed software to track portable devices. The CE also retrained all staff on its policies and procedures for using and securing ePHI.
Breach report: network180 (MI)
Type of breach: Theft
Location of breached information: Paper
Date of breach: 9/16/2011
Individuals affected: 1100
Business associate involved: Thresholds Inc.
Breach report: Premier Imaging (NC)
Type of breach: Unknown
Location of breached information: Paper
Date of breach: 9/14/2011
Individuals affected: 551
A newly hired employee impermissibly took patient registration documents home. The records taken included the protected health information of 551 patients.  The information at issue included names, addresses, birth dates, social security numbers, and driver's license numbers. As a result, the CE terminated the employee, provided notice to the affected individuals, amended registration procedures, implemented additional safeguards for such information, and offered identity theft protection to the affected individuals.
Breach report: The Good Samaritan Hospital of Cincinnati, Ohio (OH)
Type of breach: Theft
Location of breached information: Desktop Computer
Date of breach: 9/3/2011
Individuals affected: 1089
Business associate involved: Pitney Bowes Management Services, Inc.
Breach report: Bethesda Hospital, Inc. (OH)
Type of breach: Theft
Location of breached information: Desktop Computer
Date of breach: 9/3/2011
Individuals affected: 946
Business associate involved: Pitney Bowes Management Services, Inc.
Breach report: Julie A. Kennedy, D.M.D., P.A. (FL)
Type of breach: Theft
Location of breached information: Network Server
Date of breach: 9/30/2011
Individuals affected: 2900
Breach report: KCI USA, Inc. (TX)
Type of breach: Theft
Location of breached information: Other Portable Electronic Device, Other
Date of breach: 9/8/2011
Individuals affected: 567
Breach report: Lebanon Internal Medicine Associates (PA)
Type of breach: Improper Disposal
Location of breached information: Network Server
Date of breach: 9/10/2011
Individuals affected: 55000
Breach report: St. Joseph Medical Center (MD)
Type of breach: Theft
Location of breached information: Other, Paper
Date of breach: 9/11/2011
Individuals affected: 5000
Breach report: TRICARE Management Activity (TMA) (VA)
Type of breach: Loss
Location of breached information: Other
Date of breach: 9/13/2011
Individuals affected: 4900000
Business associate involved: Science Applications International Corporation (SA
Breach report: UCLA Health System (CA)
Type of breach: Theft
Location of breached information: Other Portable Electronic Device, Other
Date of breach: 9/6/2011
Individuals affected: 2761
Breach report: Logan County Emergeny Ambulance Service Authority (WV)
Type of breach: Theft, Loss
Location of breached information: Laptop
Date of breach: 10/1/2011
Individuals affected: 12563
Breach report: Lawrence Memorial Hospital (KS)
Type of breach: Unauthorized Access/Disclosure, Other
Location of breached information: Other
Date of breach: 09/20/2011 - 10/28/2011
Individuals affected: 8275
Business associate involved: Mid Continent Credit Services, Inc.
Breach report: Sutter Medical Foundation (AL)
Type of breach: Theft
Location of breached information: Desktop Computer
Date of breach: 10/15/2011
Individuals affected: 943434
Breach report: Medcenter One (ND)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 10/21/2011
Individuals affected: 650
Breach report: Dallas County Hospital District dba Parkland Health & Hospital System (TX)
Type of breach: Unauthorized Access/Disclosure
Location of breached information: Electronic Medical Record, Paper
Date of breach: 9/5/2011
Individuals affected: 2464
Breach report: University of Kentucky UK HealthCare (KY)
Type of breach: Loss
Location of breached information: Other Portable Electronic Device
Date of breach: 9/25/2011
Individuals affected: 878
Breach report: State of Tennessee Sponsored Group Health Plan (TN)
Type of breach: Unauthorized Access/Disclosure
Location of breached information: Paper
Date of breach: 10/6/2011
Individuals affected: 1770
An equipment operator at the state's postal facility set the machine to insert four (4) pages per envelope instead of one (1) page per envelope, which caused the PHI of four individuals to be sent to one address per envelope.  The error affected approximately 1770 enrollees. The letters contained information such as names, addresses, birth dates, and social security numbers. As a result, the CE retrained the employee, submitted a breach report to HHS, provided notice to the affected individuals, notified the media, created a toll-free number for information regarding the incident, posted notice on its website, modified policies to remove the SSN on templates for future mailings, and offered identity theft protection to the affected individuals. Following the OCR investigation, the CE provided reviewed its policies and procedures to ensure adequate safeguards are in place.
Breach report: Cleveland Clinic Florida (FL)
Type of breach: Loss
Location of breached information: Other
Date of breach: 10/3/2011
Individuals affected: 772
Breach report: Jay C. Platt, DDS (IN)
Type of breach: Theft
Location of breached information: Other
Date of breach: 10/6/2011
Individuals affected: 10705
Breach report: Rite Aid Corporation  (PA)
Type of breach: Other
Location of breached information: Paper
Date of breach: 10/7/2011
Individuals affected: 2900
Breach report: Advanced Occupational Medicine Specialists (IL)
Type of breach: Unauthorized Access/Disclosure
Location of breached information: Network Server
Date of breach: 10/12/2011
Individuals affected: 7226
Business associate involved: Blue Vantage Group
Breach report: Open MRI of Chicago (IL)
Type of breach: Improper Disposal
Location of breached information: Paper
Date of breach: 9/6/2011
Individuals affected: 2000
Business associate involved: Nation Wise Machine Buyers
Breach report: University of Nebraska Medical Center (NE)
Type of breach: Theft
Location of breached information: Paper
Date of breach: 11/15/2011
Individuals affected: 611
Breach report: Roberts S. Smith M.D. Inc. (GA)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 10/17/2011
Individuals affected: 17000
Breach report: Paul C. Brown, MD, PS (WA)
Type of breach: Theft
Location of breached information: Other
Date of breach: 10/14/2011 - 10/17/2011
Individuals affected: 4693
Breach report: Molina Healthcare of California (CA)
Type of breach: Other
Location of breached information: Paper
Date of breach: 9/23/2009
Individuals affected: 11081
Breach report: Aegis Sciences Corporation (TN)
Type of breach: Theft
Location of breached information: Laptop, Other Portable Electronic Device
Date of breach: 11/22/2011
Individuals affected: 2185
OCR opened an investigation of the covered entity (CE), Aegis Science Corp., after the CE reported that a laptop computer and unencrypted external hard drive containing the electronic protected health information (ePHI) of 2,185 individuals were stolen from a workforce member's vehicle.  The ePHI included social security numbers, driver's license numbers, and other demographic information, as well as bank account information of fourteen individuals and credit card information of three individuals.  Upon discovering the breach, the CE filed a police report and hired a private investigator to recover the stolen items.  The CE also initiated plans to encrypt laptops, revise security procedures, retrain employees, and offer credit monitoring to affected individuals.  As a result of OCR's investigation, the CE completed a security risk analysis and risk management report and implemented new security policies and procedures to ensure adequate safeguards to protect ePHI.  The CE also provided media notification in the two localities with greater than 500 individuals affected.  Additionally, the CE encrypted all employee computers and removable media containing ePHI and retrained employees on the CE's confidentiality and security policies.
Breach report: Soundpath Health, Inc (WA)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 11/22/2011
Individuals affected: 7581
Breach report: Concentra Health (TX)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 11/30/2011
Individuals affected: 870
Breach report: Sleep HealthCenters LLC (MA)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 11/23/2011
Individuals affected: 2988
Breach report: Smile Designs (FL)
Type of breach: Theft
Location of breached information: Desktop Computer, Network Server
Date of breach: 12/1/2011
Individuals affected: 1670
Breach report: PBH (NC)
Type of breach: Unauthorized Access/Disclosure, Other
Location of breached information: Network Server, E-mail
Date of breach: 11/15/2011
Individuals affected: 50000
Business associate involved: Alamance Caswell Local Management Entity
Breach report: CardioNet, Inc (PA)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 11/10/2011
Individuals affected: 1300
Breach report: MDwise, Inc. (IN)
Type of breach: Unauthorized Access/Disclosure
Location of breached information: Other
Date of breach: 2/10/2011
Individuals affected: 2700
Business associate involved: RightNow Technologies
Breach report: Ford Motor Company (MI)
Type of breach: Other
Location of breached information: Paper
Date of breach: 1/3/2012
Individuals affected: 1700
Business associate involved: WageWorks, Inc.
Breach report: Foundation Medical Partners (NH)
Type of breach: Theft
Location of breached information: Paper
Date of breach: 11/19/2011 - 12/01/2011
Individuals affected: 771
Without permission from the covered entity (CE), an employee provided a list of patient's names to a local counseling center as the employee was leaving the CE to begin employment at the new counseling center in an attempt to coordinate care of the patients she was treating.  The list, containing the PHI of approximately 771 individuals, included names, dates of birth, addresses, phone numbers, names of the insurance carriers, and facility codes.  Following the disclosure, the CE provided breach notification to HHS, the media, and all individuals affected and sanctioned the former employee for violating its policies and procedures. The CE also changed its procedures for list management.  The CE sent a reminder to all of its health care providers regarding the handling of PHI and made plans to provide HIPAA compliance information in a quality assurance newsletter.
Breach report: Kansas Department on Aging (KS)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 1/11/2012
Individuals affected: 7757
Breach report: Delta Dental of California (CA)
Type of breach: Other
Location of breached information: Paper
Date of breach: 12/22/2011 - 12/23/2011
Individuals affected: 11646
Breach report: Muskogee Regional Medical Center (OK)
Type of breach: Loss
Location of breached information: Other
Date of breach: 12/5/2011
Individuals affected: 844
Breach report: Department of Medical Assistance Services (VA)
Type of breach: Unauthorized Access/Disclosure, Other
Location of breached information: Paper
Date of breach: 11/02/2011 - 11/16/2011
Individuals affected: 1444
Business associate involved: ACS, Affiliated Computer Services, Inc., A Xerox Company
Breach report: Oldendorf Medical Services, PLLC (NY)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 1/17/2012
Individuals affected: 549
OCR opened an investigation of the covered entity (CE) after it reported two unencrypted laptops were stolen that contained the electronic protected health information (ePHI) of 549 individuals.  The ePHI included names, dates of birth, diagnostic test results, and social security numbers.  Upon discovery of the breach, the CE filed a police report to recover the stolen items.  As a result of OCR's investigation, the CE installed security cameras and new door locks and changed the codes to the outside entrance keypad lock.  The CE also encrypted laptop computers.
Breach report: St.Vincent Physician Network (IN)
Type of breach: Theft, Unauthorized Access/Disclosure
Location of breached information: Paper
Date of breach: 12/01/2010-11/21/2011
Individuals affected: 1423
Breach report: Flex Physical Therapy (WA)
Type of breach: Theft
Location of breached information: Desktop Computer
Date of breach: 12/30/2011
Individuals affected: 3100
Breach report: Metro Community Provider Network (CO)
Type of breach: Hacking/IT Incident, Other
Location of breached information: E-mail
Date of breach: 12/5/2011
Individuals affected: 3200
Breach report: University of Miami  (FL)
Type of breach: Theft
Location of breached information: Other Portable Electronic Device
Date of breach: 11/24/2011
Individuals affected: 1219
Breach report: UnitedHealth Group health plan single affiliated covered entity (MN)
Type of breach: Other
Location of breached information: Paper
Date of breach: 12/15/2011
Individuals affected: 6678
Breach report: Triumph, LLC (NC)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 12/13/2011
Individuals affected: 2000
Breach report: Fairview Health Services (MN)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 7/25/2011
Individuals affected: 14000
Business associate involved: Accretive Health
Breach report: Loma Linda University Medical Center (LLUMC) (CA)
Type of breach: Other
Location of breached information: Paper
Date of breach: 12/19/2011
Individuals affected: 1366
Breach report: Ford Motor Company Salaried Health Reimbursement Arrangement (HRA) Plan (MI)
Type of breach: Other
Location of breached information: Other
Date of breach: 12/29/2011
Individuals affected: 1700
Business associate involved: Affiliated Computer Services, Inc.  (ACS, Inc.) A Xerox Company
Breach report: Medco Health Solutions, Inc. (NJ)
Type of breach: Theft
Location of breached information: Paper
Date of breach: 11/30/2011
Individuals affected: 1287
 

The covered entity (CE), Medco Health Solutions, mailed letters with incorrect addresses after a programming code in its mailing software caused corruption of its data.  The mailing contained the protected health information (PHI) of 4,341 individuals and included names, medication name and prescription number.  The CE provided breach notification to HHS, the media, and affected individuals.  Upon discovery of the breach, the CE immediately ceased using the update to its mailing software system.  As a result of OCR's investigation, the CE corrected the update to its mailing software system and established manual and automated quality control processes.  The breach incident involved a BA and occurred prior to the September 23, 2013, compliance date.  OCR verified that the CE had a proper BA agreement in place that restricted the BA's use and disclosure of PHI and required the BA to safeguard all PHI.
Breach report: Lakeview Medical Center (WI)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 1/4/2012
Individuals affected: 698
Breach report: Goshen Health System, Inc. (IN)
Type of breach: Hacking/IT Incident
Location of breached information: Other
Date of breach: 12/22/2011
Individuals affected: 660
Breach report: Georgetown University Hospital (DC)
Type of breach: Unauthorized Access/Disclosure
Location of breached information: Paper
Date of breach: 11/1/2011
Individuals affected: 1549
Breach report: Motion Picture Industry Health Plans (MPI) (CA)
Type of breach: Other
Location of breached information: Other
Date of breach: 09/23/2009 - 12/02/2011
Individuals affected: 703
Breach report: Ochsner Health System (LA)
Type of breach: Loss
Location of breached information: Other Portable Electronic Device
Date of breach: 1/19/2012
Individuals affected: 2088
Breach report: Applegate Valley Family Medicine (OR)
Type of breach: Theft, Unauthorized Access/Disclosure
Location of breached information: Laptop
Date of breach: 12/01/2011-12/17/2011
Individuals affected: 2300
Business associate involved: Dr. Trandinh
Breach report: CardioNet, Inc. (PA)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 12/29/2011
Individuals affected: 728
Breach report: Presbyterian Healthcare Services (NM)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 12/29/2011
Individuals affected: 7000
Business associate involved: Beth Barrett Consulting, LLC
Breach report: Alliant Health Plans, Inc. (GA)
Type of breach: Unauthorized Access/Disclosure
Location of breached information: Other
Date of breach: 1/1/2012
Individuals affected: 632
Business associate involved: Catalyst Health Solutions, Inc.
Breach report: FIRST MEDICAL CENTER, INC. (PR)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 1/11/2012
Individuals affected: 7706
Business associate involved: T&P CONSULTING, INC. D/B/A QUANTUM
An unencrypted laptop computer and external hard drive containing the electronic protected health information (ePHI) of 7,706 individuals were stolen from a staff member of the covered entity's (CE) business associate (BA).  The ePHI included names, ages, sex, social security numbers, medical services provided, diagnosis codes, and dates of service.  Upon discovery of the breach, the CE filed a police report to recover the stolen items and provided breach notification to HHS, the media, and all individuals affected by the breach.  As a result of OCR's investigation, the CE had its BA conduct a risk analysis, implement new security policies and procedures to ensure adequate safeguards to protect ePHI, and retrain its employees.  In addition, the CE also had its BA change its security practices to include encryption on all laptops and restrict the use of portable media devices.  OCR obtained assurances that the CE implemented the corrective action listed above and required two additional corrective actions.  OCR identified the need for the CE to complete a risk assessment and implement certain security policies and procedures.
Breach report: Lee Miller Rehabilitation Associates (MD)
Type of breach: Theft
Location of breached information: Network Server
Date of breach: 1/15/2012
Individuals affected: 10480
Breach report: Jeremaih J. Twomey, F.A.C.P., P.A. (TX)
Type of breach: Theft
Location of breached information: Other
Date of breach: 12/31/2011
Individuals affected: 2559
Business associate involved: Jeremaih J. Twomey, F.A.C.P., P.A.
Breach report: Anchorage Community Mental Health Services Inc. (AK)
Type of breach: Unauthorized Access/Disclosure
Location of breached information: Desktop Computer
Date of breach: 12/20/2011 - 01/04/2012
Individuals affected: 2743
Breach report: Robley Rex VA Medical Center  (KY)
Type of breach: Other
Location of breached information: Paper
Date of breach: 1/9/2012
Individuals affected: 1182
Breach report: Indiana Internal Medicine Consultants (IN)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 2/11/2012
Individuals affected: 20000
A laptop computer that contained the electronic protected health information (ePHI) of approximately 20,000 individuals was stolen from the covered entity's (CE) laboratory manager's office.  The ePHI involved in the breach included patients' names, dates of birth, clinic identification numbers, and laboratory results.  Following the breach, the CE reported the theft to the building management company.  The management company investigated the theft and determined that cleaning personnel had stolen the laptop.  The company reported that the patient information was not compromised, as the database could not be accessed without propriety software and specialized assistance. As a result of OCR's investigation, physical security was improved by housing the replacement laptop in a locked drawer in a locked office with limited staff access.  The CE also implemented a new policy prohibiting the storage of PHI on the laptop computer and updated additional policies and procedures to enhance safeguards for systems containing PHI.
Breach report: Policlinica La Familia IPA 343 (PR)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 1/11/2012
Individuals affected: 5994
Business associate involved: T & P Consulting, Inc. d/b/a Quantum Health Consulting
An unencrypted laptop computer and external hard drive containing the electronic protected health information (ePHI) of 5,994 individuals were stolen from a staff member of the covered entity's (CE) business associate (BA).  The ePHI included names, ages, sex, social security numbers, medical services provided, diagnosis codes, and dates of service.  Upon discovery of the breach, the CE filed a police report and provided breach notification to HHS, the media and all affected individuals.  As a result of OCR's investigation, the CE had its BA conduct a risk analysis, implement new security policies and procedures to ensure adequate safeguards to protect ePHI, and retrain its employees.  In addition, the CE also had its BA change its security practices to include encryption on all laptops and restrict the use of portable media devices. OCR obtained assurance that the CE implemented the corrective action listed above and required one additional corrective action.  OCR identified the need for the CE to implement certain security policies, procedures and controls.
Breach report: Servicios Medicos Integrados de Fajardo (PR)
Type of breach: Theft
Location of breached information: Laptop, Other Portable Electronic Device
Date of breach: 1/11/2012
Individuals affected: 10000
Business associate involved: T & P Consulting, Inc. d/b/a Quantum Health Consulting
The covered entity (CE) filed a breach report with OCR after an external hard drive and laptop computer containing electronic protected health information (ePHI) of 39,609 individuals were stolen from the CE's Business Associate (BA).  The ePHI included names, ages, sex, social security numbers, medical services provided, diagnosis codes, and the dates of the service.  Immediately following the breach, the CE conducted a risk assessment, filed a breach report and provided OCR a copy of its BA agreement.  Additionally, the CE notified all affected individuals of the breach and issued a press release.  As a result of OCR's investigation, the CE required the BA to revise its security practices to include laptop encryption and restrictions on the use of portable media devices as outlined in the BA's newly developed security policies and procedures.