ScortonAI/Cyber-Security-Breaches huggingface dataset:
Breach report: Brown University (RI)
Type of breach: Other
Location of breached information: Paper
Date of breach: 12/11/2009
Individuals affected: 528
Business associate involved: Blue Cross Blue Shield of RI
On January 5, 2010, BCBSRI was notified that a 16 page report pertaining to Brown University's health plan was impermissibly disclosed to two other BCBSRI agents.  The reports contained the PHI of approximately 528 individuals.  The PHI involved: first and last names, dates of service, cost of medical care provided, and member identification numbers.  Following the breach, BCBSRI recovered the reports, received written assurances that any electronic copies of the reports were deleted, notified affected individuals of the breach, implemented new procedure for all outgoing correspondence, and is in the process of auditing all affected members' claim history to ensure no fraud.
Breach report: MMM Heath Care Inc.  (PR)
Type of breach: Theft
Location of breached information: Paper
Date of breach: 2/4/2010
Individuals affected: 1907
Business associate involved: MSO of Puerto Rico, Inc. 
The covered entity's (CE) business associate (BA) erroneously merged two lists which led to the disclosure of protected health information (PHI) of 1,907 individuals.  The PHI included names, internal identification numbers, and the number of emergency room visits.  Upon discovery of the breach, the CE's BA established a quality control process in order to ensure adequate safeguards for that letters that are sent by mail.  As a result of OCR's investigation, the CE created and implemented additional policies and procedures for quality control of mailings.  The CE also provided training to all staff on its revised privacy and security policies and procedures.
Breach report: PMC Medicare Choice (PR)
Type of breach: Theft
Location of breached information: Paper
Date of breach: 2/4/2010
Individuals affected: 605
Business associate involved: MSO of Puerto Rico
The covered entity's (CE) business associate (BA) erroneously merged two lists which led to the disclosure of protected health information (PHI) of 605 individuals.  The PHI included names, internal identification numbers, and the number of emergency room visits.  Upon discovery of the breach, the CE's BA established a quality control process in order to ensure adequate safeguards for that letters that are sent by mail.  As a result of OCR's investigation, the CE created and implemented additional policies and procedures for quality control of mailings.  The CE also provided training to all staff on its revised privacy and security policies and procedures.
Breach report: Cardiology Consultants/Baptist Health Care Corporation (FL)
Type of breach: Theft
Location of breached information: Desktop Computer
Date of breach: 12/19/2009
Individuals affected: 8000
A desktop computer that contained the e-PHI of approximately 8,000 individuals was stolen from the covered entity's (CE) locked medical suite.  The PHI involved in the breach included names, dates of birth, medical record numbers, ultrasound information, exam dates, and reasons for the ultrasound.  The computer that was stolen used proprietary software and a special electronic key to access the PHI.  The CE provided breach notification to affected individuals, HHS, and the media and posted substitute notification on its website.  Following the breach, the CE worked with law enforcement to identify the possible suspect.  The CE upgraded its facility access controls to include proximity card readers for every location that stores PHI.  As a result of OCR's investigation the CE updated its risk analysis and carried out additional risk management activities.
Breach report: State of TN, Bureau of TennCare (TN)
Type of breach: Theft
Location of breached information: Paper
Date of breach: 12/23/2009
Individuals affected: 3900
The covered entity (CE) mailed the wrong information to 3,900 individuals based on a corrupted data file it received from a state agency.  The types of PHI involved were names, dates of birth, social security numbers, member identification numbers, and in some cases, diagnoses, treatments, conditions, and medications.  Following the breach, the CE immediately fixed the corrupted file and mailed corrected letters.  The CE provided breach notification to HHS, the media, and affected individuals and provided substitute notification by posting on its website.  It also offered affected individuals one year of free credit monitoring and comprehensive credit services.  The CE also worked with the state agency to implement a new procedure to improve safeguards for PHI.  OCR obtained assurances that the CE implemented the corrective action listed above.
Breach report: Lucille Packard Children's Hospital (CA)
Type of breach: Other
Location of breached information: Desktop Computer
Date of breach: 1/11/2010
Individuals affected: 532
Breach report: University of New Mexico Health Sciences Center (NM)
Type of breach: Other
Location of breached information: Desktop Computer
Date of breach: 2/8/2010
Individuals affected: 1900
Breach report: Advanced NeuroSpinal Care (CA)
Type of breach: Theft
Location of breached information: Network Server
Date of breach: 12/30/2009
Individuals affected: 3500
A computer containing the electronic protected health information (ePHI) of 3,500 individuals was stolen from the office of a covered entity (CE).  The ePHI included patient names, addresses, dates of birth, social security numbers, driver's licenses, claims information, diagnoses, and conditions. As a result of the loss, the CE upgraded the alarm system and replaced the server housing and storage security lock-up.  The CE also notified affected individuals, the media, appropriate government agencies, and law enforcement.  In addition, the CE established an office-based hotline to assist affected individuals.  As a result of OCR's investigation, the CE has implemented regularly scheduled security risk analyses and has installed window bars, roll down shutters, four video surveillance cameras, and other physical security measures to prevent theft.
Breach report: Aspen Dental Care P.C. (CO)
Type of breach: Theft
Location of breached information: Other
Date of breach: 10/4/2009
Individuals affected: 2500
A computer hard drive containing encrypted patient records was stolen from the covered entity's (CE) safe.  The hard drive contained clinical and demographic information of approximately 2,500 patients.  Following the breach, the CE provided additional training to its staff.  OCR obtained assurances that the CE implemented the corrective action listed above.
Breach report: Shands at UF (FL)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 1/27/2010
Individuals affected: 12580
A laptop containing certain information collected on approximately 12,580 individuals referred to Shands at UF GI Clinical Services was stolen from the private residence of an employee.  The stolen information included patient names, social security numbers, and medical record numbers.  As a result of the incident, the employee was counseled by her supervisor, issued written corrective action with a 3-day suspension, and provided additional HIPAA training.  OCR reviewed Shands at UF's most recent Risk Analysis and Risk Management Plans and they revealed no high risk findings related to encryption, workstation use, or physical security.  OCR's investigation found that Shands at UF has implemented appropriate technical safeguards, such as secure VPN network connections and network storage for workforce usage, encrypted USB portable flash drives, and PGP whole disk encryption.
Breach report: Wyoming Department of Health (WY)
Type of breach: Unauthorized Access/Disclosure 
Location of breached information: Network Server
Date of breach: 12/2/2009
Individuals affected: 9023
Breach report: Thrivent Financial for Lutherans (WI)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 1/29/2010
Individuals affected: 9500
On January 29, 2010, there was a break-in at one of the Thrivent's offices and five laptop computers were stolen; four of the five laptops were recovered.  The missing laptop computer contained the protected health information of approximately 9,400 individuals.    The protected health information involved in the breach included name, address, date of birth, social security number, prescription drugs, medical condition, age, weight, etc. Thrivent provided OCR with additional controls to remedy causes of security breach at various stages of implementation.  The actions taken by the CE prior to OCR's formal investigation brought the CE into compliance.
Breach report: North Carolina Baptist Hospital (NC)
Type of breach: Theft
Location of breached information: Paper
Date of breach: 2/15/2010
Individuals affected: 554
Breach report: Montefiore Medical Center (NY)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 2/20/2010
Individuals affected: 625
An unencrypted laptop computer containing the electronic protected health information (ePHI) of 625 individuals was stolen from the covered entity's (CE) mobile dental van.  The ePHI included names, dates of birth, medical record numbers and dental x-rays.  Upon discovery of the breach, the CE filed a police report and provided breach notification to HHS, the media and affected individuals.  As a result of OCR's investigation, the CE revised its procedures so that all ePHI is stored in a data center, rather than the mobile dental van laptop.  In addition, the CE encrypted all mobile dental van laptops and improved physical security for the van.  The CE developed a new policy on ePHI security and retrained all staff.  OCR obtained assurances that the CE implemented the corrective action listed above.
Breach report: Ernest T. Bice, Jr. DDS, P.A. (TX)
Type of breach: Theft
Location of breached information: Other Portable Electronic Device, Other
Date of breach: 2/20/2010
Individuals affected: 21000
Three unencrypted external back-up drives were stolen from a safe in the covered entity's locked office.  The laptop computer contained the protected health information of approximately 21,000 individuals.  The protected health information involved in the breach included names, addresses phone numbers, dates of birth, social security numbers, insurance information, and treatment histories.  Following the breach, the covered entity moved back-up data offsite and encrypted all workstations.  Additionally, OCR's investigation resulted in the covered entity improving their physical safeguards and in retraining employees.
Breach report: Lee Memorial Health System (FL)
Type of breach: Other
Location of breached information: Paper
Date of breach: 1/29/2010
Individuals affected: 3800
The covered entity sent postcards to approximately 3,800 patients, which listed the patients' demographic information, and a statement that read, 'Your Physician Has Moved,'  with a name and description of the practice, Infectious Disease Specialist. The types of PHI involved were demographic and clinical information. Voluntary actions taken prior to OCR's investigation include the issuance of sanctions and review of policies and procedures.
Breach report: Laboratory Corporation of America/Dynacare Northwest, Inc. (WA)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 2/12/2010
Individuals affected: 5080
A laptop computer was stolen from a workforce member's car.  The laptop computer contained the protected health information of approximately 5080 individuals.  The protected health information involved in the breach included names, addresses, dates of birth, Social Security numbers, and lab results.  Following the breach, the covered entity encrypted all laptop computers.
Breach report: Mount Sinai Medical Center (FL)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 3/9/2010
Individuals affected: 2600
Breach report: Griffin Hospital (CT)
Type of breach: Hacking/IT Incident
Location of breached information: Network Server
Date of breach: 2/4/2010
Individuals affected: 957
Breach report: Hypertension, Nephrology, Dialysis and Transplantation, PC (AL)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 3/6/2010
Individuals affected: 2465
Breach report: Reliant Rehabilitation Hospital North Houston (TX)
Type of breach: Unauthorized Access/Disclosure 
Location of breached information: E-mail
Date of breach: 2/9/2010
Individuals affected: 768
Business associate involved: Computer Program and Systems, Inc. (CPSI)
Breach report: Laboratory Corporation of America / US LABS / Dianon Systems, Inc (AZ)
Type of breach: Theft
Location of breached information: Other Portable Electronic Device
Date of breach: 2/18/2010
Individuals affected: 2773
Breach report: University of Pittsburgh Student Health Center (PA)
Type of breach: Theft, Loss
Location of breached information: Paper
Date of breach: 3/11/2010
Individuals affected: 8000
Breach report: Providence Hospital (MI)
Type of breach: Other
Location of breached information: Other
Date of breach: 2/4/2010
Individuals affected: 83945
Breach report: VHS Genesis Lab Inc.  (IL)
Type of breach: Loss
Location of breached information: Paper
Date of breach: 1/10/2010
Individuals affected: 6800
Breach report: John Muir Physician Network (CA)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 2/4/2010
Individuals affected: 5450
Breach report: Beatrice Community Hospital and Health Center (NE)
Type of breach: Other
Location of breached information: Paper
Date of breach: 3/19/2010
Individuals affected: 660
Business associate involved: McKesson Information Solutions, LLC
Breach report: Pediatric Sports and Spine Associates (TX)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 2/10/2010
Individuals affected: 955
An unencrypted laptop was stolen from an employee's vehicle.  The laptop contained the protected health information of approximately 955 individuals.  The protected health information involved in the breach included names, addresses, dates of birth, social security numbers, diagnoses, medications and other treatment information.  Following the discovery of the breach, the covered entity revised policies, retrained staff and implemented additional physical and technical safeguards including encryption software.  The covered entity also removed the stolen laptop's access to the server, sanctioned the involved employee, notified the affected individuals and notified the local media.
Breach report: Affinity Health Plan, Inc. (NY)
Type of breach: Theft
Location of breached information: Other
Date of breach: 11/24/2009
Individuals affected: 344579
Breach report: Tomah Memorial Hospital (WI)
Type of breach: Other
Location of breached information: Other
Date of breach: 3/19/2010
Individuals affected: 600
Breach report: Praxair Healthcare Services, Inc. (Home Care Supply in NY) (CT)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 2/18/2010
Individuals affected: 54165
A laptop computer was stolen from the covered entity's office by a former employee after it had been damaged. The laptop computer contained the PHI of approximately 54,165 individuals.  The computer contained a limited amount of PHI, including client names and one or more of the following: addresses, phone numbers, social security numbers, insurance provider names and policy numbers, medical diagnostic codes or medical equipment.  Following the breach, the covered entity notified all affected individuals, the media, and HHS of the breach. Additionally, the covered entity completed its laptop encryption project to cover all PHI stored on computers in the office.  Additionally, OCR's investigation resulted in the covered entity reinforcing the requirements of HIPAA to its employees.
Breach report: Massachusetts Eye and Ear Infirmary (MA)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 2/19/2010
Individuals affected: 3594
Breach report: Blue Cross & Blue Shield of Rhode Island (RI)
Type of breach: Theft
Location of breached information: Paper
Date of breach: 12/20/2009
Individuals affected: 12000
A covered entity (CE) donated a file cabinet containing the protected health information (PHI) of 12,000 individuals before cleaning it out.  The PHI included members' names, addresses, telephone numbers, social security numbers, and Medicare identification numbers.  The covered entity (CE) provided breach notification to HHS, the affected individuals, and media, and offered all affected individuals free credit monitoring for a period of one year.  Following the breach, the CE sanctioned the employees involved in the incident and held a mandatory training regarding the HIPAA Privacy and Security Rule for all departments involved in the breach. The CE also revised the policy for office moves.  OCR obtained assurances that the CE implemented the corrective action listed above.
Breach report: South Carolina Department of Health and Environmental Control (SC)
Type of breach: Improper Disposal
Location of breached information: Paper
Date of breach: 2/17/2010
Individuals affected: 2850
Breach report: St. Joseph Heritage Healthcare (CA)
Type of breach: Theft
Location of breached information: Desktop Computer
Date of breach: 3/6/2010
Individuals affected: 22012
22 computers were stolen from Clinical Management Service office.Five of the stolen computers contained the protected health information of approximately 22,012 individuals. The protected health information involved in the breach included name, date of birth, social security number, referral number, encounter number, facility, member ID, diagnosis, procedure, and/or diagnosis code. As a result of this incident, St. Joseph notified the potentially affected individuals, notified the local media, installed security cameras, re-trained employees, and installed encryption software on all laptops and Computers enterprise-wide. OCR's investigation resulted in the covered entity improving their physical and technological safeguards and retraining employees.
Breach report: Medical Center At Bowling Green (KY)
Type of breach: Theft
Location of breached information: Other Portable Electronic Device, Other
Date of breach: 3/24/2010
Individuals affected: 5148
Breach report: GENERAL AGENCIES WELFARE BENEFITS PROGRAM (TN)
Type of breach: Loss
Location of breached information: Other
Date of breach: 2/5/2010
Individuals affected: 1874
Business associate involved: TOWERS WATSON
Breach report: UnitedHealth Group health plan single affiliated covered entity (MN)
Type of breach: Theft
Location of breached information: Other, Paper
Date of breach: 3/2/2010
Individuals affected: 735
Breach report: South Texas Veterans Health Care System (TX)
Type of breach: Loss, Improper Disposal
Location of breached information: Paper
Date of breach: 9/30/2009
Individuals affected: 1430
Breach report: Rockbridge Area Community Services (VA)
Type of breach: Theft
Location of breached information: Laptop, Desktop Computer
Date of breach: 3/12/2010
Individuals affected: 500
Breach report: Emergency Healthcare Physicians, Ltd. (IL)
Type of breach: Theft
Location of breached information: Other Portable Electronic Device, Other
Date of breach: 2/27/2010
Individuals affected: 180111
Business associate involved: Millennium Medical Management Resources, Inc.
Breach report: VA Eastern Colorado Health Care System (CO)
Type of breach: Theft
Location of breached information: Paper
Date of breach: 1/19/2010
Individuals affected: 649
A covered entity's (CE's) employee placed paper records containing protected health information (PHI) in an unsecured box that was left undiscovered in a public parking garage for four days.  The box contained the PHI of 649 patients.  The PHI included treatment records, productivity reports, coding information, names, medical treatments, conditions, diagnoses, and social security numbers.  Upon discovery of the breach, the CE notified the affected individuals and provided credit protection to those whose social security numbers had been breached.  The CE provided OCR with copies of its breach prevention policies and procedures. Following OCR's investigation, the employee who left the records resigned from her position and the CE improved its breach response procedures.
Breach report: Miami VA Healthcare System (FL)
Type of breach: Loss
Location of breached information: Paper
Date of breach: 1/19/2010
Individuals affected: 568
Breach report: Heriberto Rodriguez-Ayala, M.D. (TX)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 4/3/2010
Individuals affected: 4200
Breach report: Georgetown University Hospital (DC)
Type of breach: Theft, Other
Location of breached information: E-mail, Other Portable Electronic Device
Date of breach: 3/26/2010
Individuals affected: 2416
An employee of the covered entity emailed protected health information (PHI) to an offsite research office (which is not itself a covered entity) in violation of the review preparatory to research protocol.  The research office stored the electronic information on an external hard drive that was later stolen.  The device contained the PHI of 2,416 individuals.  The PHI involved in the breach included names, dates of birth, and clinical information.  In response to this incident, the covered entity terminated transmission of the PHI to this research office and gave the responsible employee a verbal warning and counseling.  Additionally, the covered entity undertook a review of all research affiliations involving PHI of hospital patients to confirm that appropriate documentation and procedures are in place.
Breach report: Silicon Valley Eyecare Optometry and Contact Lenses (CA)
Type of breach: Theft
Location of breached information: Network Server
Date of breach: 4/2/2010
Individuals affected: 40000
Breach report: Loma Linda University Health Care (CA)
Type of breach: Theft
Location of breached information: Desktop Computer
Date of breach: 4/4/2010
Individuals affected: 584
Breach report: Veterans Health Administration (DC)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 4/22/2010
Individuals affected: 656
Business associate involved: Heritage Health Solutions
Breach report: State of New Mexico Human Services Department, Medical Assistance Division (NM)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 3/20/2010
Individuals affected: 9600
Business associate involved: DentaQuest
Breach report: Oconee Physician Practices (SC)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 5/9/2010
Individuals affected: 653
Breach report: University of Rochester Medical Center and Affiliates (NY)
Type of breach: Other
Location of breached information: Paper
Date of breach: 4/19/2010
Individuals affected: 2628
Breach report: Omaha Construction Industry Health and Welfare Plan (NE)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 1/11/2009
Individuals affected: 800
Business associate involved: DeBoer & Associates
Breach report: City of Charlotte, NC (Health Plan) (NC)
Type of breach: Loss
Location of breached information: Other
Date of breach: 2/3/2010
Individuals affected: 5220
Breach report: VA North Texas Health Care System (TX)
Type of breach: Improper Disposal
Location of breached information: Paper
Date of breach: 5/4/2010
Individuals affected: 4083