ScortonAI/Cyber-Security-Breaches huggingface dataset:
Breach report: Visiting Nurse Service Association of Schenectady County (NY)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 9/14/2010
Individuals affected: 535
An encrypted laptop computer that contained the electronic protected health information (ePHI) of 535 individuals was stolen from the covered entity (CE).  The ePHI included names, addresses, and dates of birth.  Upon discovery of the breach, the CE filed a police report to recover the stolen item.  Following OCR's investigation, the CE disabled the involved staff member's account, verbally counseled the staff member, and retrained the staff member.  The CE also adopted and implemented security policies and procedures for laptops/tablet devices and provided training to all staff.
Breach report: Manor Care Indy (South), LLC. (IN)
Type of breach: Unauthorized Access/Disclosure
Location of breached information: Paper
Date of breach: 9/11/2010
Individuals affected: 845
Breach report: Robert Wheatley, DDS, PC (MO)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 10/17/2010
Individuals affected: 1400
Breach report: Henry Ford Hospital (MI)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 9/24/2010
Individuals affected: 3700
Breach report: Holy Cross Hospital (FL)
Type of breach: Theft
Location of breached information: Paper
Date of breach: 7/27/2010
Individuals affected: 1500
Breach report: Newark Beth Israel Medical Center (NJ)
Type of breach: Theft
Location of breached information: Network Server
Date of breach: 1/1/2010
Individuals affected: 1744
Business associate involved: Professional Transcription Company, Inc.
The covered entity's (CE) business associate (BA), Professional Transcription Company, posted the electronic protected health information (ePHI) of 1,744 individuals on a website portal of the BA.  The ePHI included names, dates of birth, diagnosis, and other clinical information.  Upon discovery of the breach, the BA shut down the applicable server.  The CE, Newark Beth Israel Medical Center, provided breach notification to HHS, the media, and affected individuals and also posted substitute notice on its website.  As a result of OCR's investigation, the BA located the ePHI online and contacted Google to block files that contained ePHI.  In addition, the BA retrained all employees regarding its security policies.  The CE terminated its BA agreement with the BA.  The breach incident involved a BA and occurred prior to the September 23, 2013, compliance date.  OCR verified that the CE had a proper BA agreement in place that restricted the BA's use and disclosure of PHI and required the BA to safeguard all PHI.
Breach report: Memorial Hospital of Gardena (CA)
Type of breach: Unauthorized Access/Disclosure
Location of breached information: Paper
Date of breach: 10/14/2010
Individuals affected: 771
Breach report: Oklahoma City VA Medical Center (OK)
Type of breach: Theft, Loss, Improper Disposal
Location of breached information: Paper
Date of breach: 10/8/2010
Individuals affected: 1950
Breach report: Albert Einstein Healthcare Network (PA)
Type of breach: Theft
Location of breached information: Desktop Computer
Date of breach: 10/21/2010
Individuals affected: 613
Breach report: Kings County Hospital Center (NY)
Type of breach: Theft
Location of breached information: Desktop Computer
Date of breach: 8/22/2010
Individuals affected: 542
An unencrypted desktop computer that contained the electronic protected health information (ePHI) of 542 individuals was stolen from the covered entity (CE), Kings County Hospital Center.  The ePHI included names, medical record numbers, admission and treatment dates, diagnostic treatment, pathology and/or medication information, telephone numbers and ages.  Upon discovery of the breach, the CE filed a police report and provided breach notification to affected individuals, HHS, and the media.  As a result of OCR's investigation, the CE installed an encryption system for all internal and external computers and laptops.  The CE implemented a new policy that prohibits staff from storing ePHI on their local computer hard drives or Windows desktop.
Breach report: University of Tennessee Medical Center (TN)
Type of breach: Improper Disposal
Location of breached information: Paper
Date of breach: 9/23/2009
Individuals affected: 8200
Breach report: Ochsner Health System (LA)
Type of breach: Unauthorized Access/Disclosure
Location of breached information: Paper
Date of breach: 9/27/2010
Individuals affected: 9475
Business associate involved: H.E.L.P. Financial Corporation
A programming error in a business associate's IT system caused the PHI of patients to be printed on letters sent to other patients. The printing error affected approximately 9475 individuals.The protected health information involved in the breach included patient names, medical record numbers and account balances. Following the discovery of the breach, the BA corrected the programming error and implemented additional quality checks. Additionally, the BA notified the affected individuals and the CE notified the local media.
Breach report: zarzamora family dental care (TX)
Type of breach: Theft
Location of breached information: Desktop Computer
Date of breach: 10/15/2010
Individuals affected: 800
Breach report: Hospital Auxilio Mutuo (PR)
Type of breach: Theft, Unauthorized Access/Disclosure, Hacking/IT Incident
Location of breached information: Laptop, Desktop Computer
Date of breach: 11/9/2010
Individuals affected: 1000
Breach report: Pinnacle Health System (PA)
Type of breach: Unauthorized Access/Disclosure
Location of breached information: Network Server
Date of breach: 10/1/2008
Individuals affected: 1085
Business associate involved: Gair Medical Transcription Services, Inc.
Pinnacle Health Systems was notified that a business associate, a medical transcription service, had a server compromised in which reports of Pinnacle patients could be viewed online.  The server compromise involved the protected health information of 1085 individuals.  The protected health information involved in the breach included names, Medicaid ID numbers, dates of birth, and primary physicians.  In response to this incident, the covered entity took steps to enforce the requirements of the Privacy & Security Rules.  The covered entity immediately discontinued its relationship with the business associate and engaged another medical transcription service.  The covered entity also contracted with forensic consultants to ensure that the cause of the compromise was found that that all traces of breached medical reports were removed from online and inaccessible in the future.
Breach report: Gary C. Spinks, DMD, PC (MD)
Type of breach: Hacking/IT Incident
Location of breached information: Desktop Computer, Network Server
Date of breach: 9/29/2010
Individuals affected: 1000
Breach report: Cook County Health & Hospitals System (IL)
Type of breach: Theft
Location of breached information: Desktop Computer
Date of breach: 11/1/2010
Individuals affected: 556
Breach report: Dean Health Systems, Inc.; St. Mary's Hospital; St. Marys Dean Ventures, Incorporated (WI)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 11/8/2010
Individuals affected: 3288
Breach report: Riverside Mercy Hospital and Ohio/Mercy Diagnostics (OH)
Type of breach: Improper Disposal
Location of breached information: Paper
Date of breach: 3/29/2003
Individuals affected: 1000
Breach report: California Therapy Solutions (CA)
Type of breach: Theft
Location of breached information: Other Portable Electronic Device, Other
Date of breach: 11/11/2010
Individuals affected: 1250
Breach report: Osceola Medical Center (WI)
Type of breach: Unauthorized Access/Disclosure
Location of breached information: Other
Date of breach: 11/25/2010
Individuals affected: 585
Business associate involved: Hils Transcription
Breach report: Indiana Family and Social Services Administration (IN)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 11/4/2010
Individuals affected: 757
Business associate involved: The Southwestern Indiana Regional Council on Aging
Breach report: Mankato Clinic (MN)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 11/1/2010
Individuals affected: 3159
Breach report: Geisinger Wyoming Valley Medical Center (PA)
Type of breach: Unauthorized Access/Disclosure
Location of breached information: E-mail
Date of breach: 11/3/2010
Individuals affected: 2928
Breach report: Our Lady of Peace Hospital (KY)
Type of breach: Theft, Loss
Location of breached information: Other Portable Electronic Device, Other
Date of breach: 3/31/2010
Individuals affected: 24600
Breach report: International Union of Operating Engineers Health and Welfare Fund  (MD)
Type of breach: Theft
Location of breached information: Paper
Date of breach: 10/25/2010
Individuals affected: 800
Business associate involved: Zenith Administrators, Inc.
Breach report: Southern Perioperative Services, P.C. (AL)
Type of breach: Theft
Location of breached information: Other Portable Electronic Device, Other
Date of breach: 11/17/2010
Individuals affected: 2000
Breach report: Keystone/AmeriHealth Mercy Health Plans (PA)
Type of breach: Loss
Location of breached information: Other Portable Electronic Device, Other
Date of breach: 9/20/2010
Individuals affected: 808
Breach report: Ankle + Foot Center of Tampa Bay, Inc. (FL)
Type of breach: Theft
Location of breached information: Network Server
Date of breach: 10/28/2010
Individuals affected: 156000
The covered entity's (CE) network server, containing the electronic protected health information (ePHI) of 136,000 patients, was hacked.  The types of ePHI involved in the breach were demographic and clinical information, including diagnoses and other treatment data.  Following the breach, the CE hired a third party vendor to resolve a data crash and to create a data back-up plan in order to restore office functioning.  To implement adequate safeguards, the CE also employed a cloud service with increased security as the new network server.  Additionally, the CE contacted the local FBI office to assist with the CE's internal investigation of the breach and provided breach notification to all affected individuals, the media, and HHS.  As a result of OCR's investigation, the CE developed and implemented new protocols to comply with the Security Rule.  In addition, the CE provided and initiated new trainings for its staff, completed hiring of a new network vendor, implemented a new electronic health records system, and accounted for the disclosures in the affected individuals' medical records.
Breach report: OhioHealth Corporation dba Grant Medical Center (OH)
Type of breach: Theft
Location of breached information: Laptop, Desktop Computer
Date of breach: 1/1/2008
Individuals affected: 501
Breach report: Seacoast Radiology, PA (NH)
Type of breach: Hacking/IT Incident
Location of breached information: Network Server
Date of breach: 11/12/2010
Individuals affected: 231400
Breach report: Friendship Center Dental Office (FL)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 12/19/2010
Individuals affected: 2200
Breach report: Centra (VA)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 11/11/2010
Individuals affected: 11982
Breach report: St.Vincent Hospital - Indianapolis (IN)
Type of breach: Hacking/IT Incident
Location of breached information: Network Server, E-mail
Date of breach: 11/12/2010
Individuals affected: 1848
Breach report: Texas Health Harris Methodist Hospital Azle (TX)
Type of breach: Theft, Loss
Location of breached information: Other Portable Electronic Device, Other
Date of breach: 4/7/2010
Individuals affected: 9922
Breach report: Franciscan Medical Group (WA)
Type of breach: Theft
Location of breached information: Desktop Computer
Date of breach: 11/18/2010
Individuals affected: 1250
Breach report: State of South Carolina Budget and Control Board Employee Insurance Program (EIP) (SC)
Type of breach: Hacking/IT Incident
Location of breached information: Desktop Computer
Date of breach: 11/8/2010
Individuals affected: 5596
Breach report: Lake Woods Nursing & Rehabilitation Center (MI)
Type of breach: Theft
Location of breached information: Laptop, Desktop Computer
Date of breach: 12/28/2010
Individuals affected: 656
Breach report: Benefit Resources, Inc. (SC)
Type of breach: Loss
Location of breached information: Other Portable Electronic Device, Other
Date of breach: 10/13/2010
Individuals affected: 16200
Business associate involved: Travis Software Corp.
Breach report: Baptist Memorial Hospital - Huntingdon (TN)
Type of breach: Theft
Location of breached information: Other
Date of breach: 11/27/2010
Individuals affected: 4800
Business associate involved: J. A. Still Corporation
Two diskettes containing the electronic protected health information (ePHI) of approximately 4,754 individuals were lost by the Covered Entity's (CE) Business Associate (BA) after the package containing the diskettes was damaged by the mail carrier.  Although one of the diskettes was eventually found, the other diskette was never recovered.  The ePHI on the diskettes included names, addresses, dates of birth, social security numbers, and clinical information.  Upon discovery of the breach, the CE obtained a copy of the information contained on the diskettes and notified all affected individuals, OCR and the media.  Following OCR's investigation, the CE terminated its contract with the BA involved in the incident and provided evidence of the assurances in its BA agreement pertaining to the return or destruction of ePHI.  Lastly, the CE entered an accounting of disclosures for each affected individual into its electronic database.
Breach report: Grays Harbor Pediatrics, PLLC (WA)
Type of breach: Theft
Location of breached information: Other Portable Electronic Device, Other
Date of breach: 11/23/2010
Individuals affected: 12009
Breach report: Hanger Prosthetics & Orthotics, Inc. (TX)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 11/24/2010
Individuals affected: 4486
An unencrypted laptop was stolen from an employee offsite.  The laptop contained the PHI of 4,486 patients. The protected health information involved in the breach contained names, addresses and procedure codes. Following the breach, the CE filed a police report, notified affected patients and notified the media. Following the discovery of the breach, the covered entity encrypted all existing laptops and implemented a policy requiring all future purchased laptops to be encrypted prior to being issued for use.
Breach report: Baylor Heart and Vascular Center (TX)
Type of breach: Theft
Location of breached information: Other Portable Electronic Device, Other
Date of breach: 12/2/2010
Individuals affected: 8241
A portable ultrasound machine containing electronic protected health information (ePHI) of approximately 8,241 individuals was stolen from the covered entity's (CE) facility.  The ePHI involved in the breach included patient names, dates of birth, and limited health information.  Upon discovery of the breach, the CE conducted a privacy and security assessment of its portable machines to identify vulnerabilities.  Following OCR's investigation, the CE updated its privacy and security policies, retrained its employees, and increased physical security to ensure reasonable safeguards.
Breach report: CHC MEMPHIS CMHC, LLC (TN)
Type of breach: Theft
Location of breached information: Desktop Computer
Date of breach: 12/4/2010
Individuals affected: 500
Breach report: Jefferson Center for Mental Health (CO)
Type of breach: Theft
Location of breached information: Paper
Date of breach: 12/13/2010
Individuals affected: 546
Breach report: Green River District Health Department (KY)
Type of breach: Hacking/IT Incident
Location of breached information: Network Server
Date of breach: 1/12/2011
Individuals affected: 18871
Business associate involved: Integranetics
Breach report: Ortho Montana, PSC (MT)
Type of breach: Theft, Loss
Location of breached information: Laptop
Date of breach: 1/8/2011
Individuals affected: 37000
Breach report: Cancer Care Northwest P.S. (WA)
Type of breach: Theft
Location of breached information: Paper
Date of breach: 1/7/2011
Individuals affected: 3100
The covered entity (CE) accidentally mailed the protected health information (PHI) of approximately 3,100 individuals to other individuals when a mail-merge process mismatched names and addresses.  The PHI involved in the breach included names and indicated that the individuals were patients of the CE.  Following the breach, the CE implemented additional safeguards, as well as policies and procedures to ensure mailing list accuracy.  As a result of this incident, OCR required the CE to train its workforce members on its newly developed policies and procedures.  Additionally, OCR provided technical assistance regarding substitute breach notification methods, including a conspicuous posting on the CE's website.
Breach report: Saint Louis University (MO)
Type of breach: Hacking/IT Incident
Location of breached information: Desktop Computer
Date of breach: 12/11/2010
Individuals affected: 800
Breach report: New York City Health & Hospitals Corporation's North Bronx Healthcare Network (NY)
Type of breach: Theft
Location of breached information: Other, Electronic Medical Record
Date of breach: 12/23/2010
Individuals affected: 1700000
Business associate involved: GRM Information Management Services
Unencrypted clinical system backup tapes that contained the electronic protected health information (ePHI) of 1,700,000 individuals were stolen from the unlocked vehicle of an employee of the covered entity's (CE) business associate (BA).  The ePHI included names, medical record numbers, social security numbers, addresses, telephone numbers, health plan numbers, dates of birth, dates of admission, dates of treatment, dates of discharge, dates of death, mother's name, next of kin, clinical information related to diagnosis, treatment, prognosis, laboratory tests and results, and medications.  Upon discovery of the breach, the CE filed a police report to recover the stolen items and provided breach notification to HHS, the media, and affected individuals.  As a result of OCR's investigation, the CE terminated its BA agreement and installed encryption software on backup media.  The breach incident involved a BA and occurred prior to the September 23, 2013, compliance date.  OCR verified that the CE had a proper BA agreement in place that restricted the BA's use and disclosure of PHI and required the BA to safeguard all PHI.
Breach report: Long Beach Memorial Medical Center (CA)
Type of breach: Unauthorized Access/Disclosure
Location of breached information: Other
Date of breach: 12/10/2010
Individuals affected: 2250
Breach report: Walgreen Co. (IL)
Type of breach: Theft
Location of breached information: Other Portable Electronic Device, Other
Date of breach: 1/26/2011
Individuals affected: 2700
Business associate involved: Business Express
Breach report: Charleston Area Medical Center, Inc (WV)
Type of breach: Unauthorized Access/Disclosure
Location of breached information: Network Server
Date of breach: 2/8/2011
Individuals affected: 3655
Business associate involved: Xforia Web Services
Breach report: Mountain Vista Medical Center (AZ)
Type of breach: Loss
Location of breached information: Other Portable Electronic Device, Other
Date of breach: 10/13/2010
Individuals affected: 2291
Breach report: Departamento de Salud de Puerto Rico (PR)
Type of breach: Unknown
Location of breached information: Desktop Computer
Date of breach: 3/14/2010
Individuals affected: 2621
Breach report: Henry Ford Hospital (MI)
Type of breach: Loss
Location of breached information: Other Portable Electronic Device, Other
Date of breach: 1/31/2011
Individuals affected: 2777
Breach report: Central Brooklyn Medical Group, PC (NY)
Type of breach: Theft
Location of breached information: Paper
Date of breach: 8/3/2010
Individuals affected: 500
OCR opened an investigation of the covered entity (CE), Preferred Health Partners f/k/a Central Brooklyn Medical Group, after it reported appointment schedules, pathology reports and portions of medical records containing the protected health information (PHI) of 500 individuals were stolen from an office.  The PHI included names, ages, telephone numbers, social security numbers, medical insurance information, pathology reports, and other clinical information.  Upon discovery of the breach, the CE filed a police report and worked with law enforcement authorities to recover as much of the PHI as possible that was stolen.  As a result of OCR's investigation, the CE removed PHI such as social security or medical insurance numbers from tracking logs.  In addition, the CE improved safeguards by storing log binders in a locked area and shredding documents regularly.  Further, the CE replaced the manual process of printing certain records with an electronic verification system.  The CE also archived, stored off site, and locked up all paper records and retrained all staff on its HIPAA policies and procedures.
Breach report: TRICARE Management Activity (CO)
Type of breach: Unauthorized Access/Disclosure
Location of breached information: Paper
Date of breach: 6/25/2010
Individuals affected: 4500
Breach report: Blue Cross and Blue Shield of Florida  (FL)
Type of breach: Unknown
Location of breached information: Other
Date of breach: 10/16/2010
Individuals affected: 7366
Breach report: University Health Services, University of Massachusetts, Amherst (MA)
Type of breach: Unauthorized Access/Disclosure
Location of breached information: Desktop Computer
Date of breach: 9/29/2010
Individuals affected: 942
Breach report: Omnicare, Inc (KY)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 1/19/2011
Individuals affected: 8845
Breach report: JEFFREY J. SMITH, MD (OK)
Type of breach: Loss
Location of breached information: Desktop Computer, Other Portable Electronic Device, Other
Date of breach: 11/24/2010
Individuals affected: 600
Breach report: University of Missouri Health Plan (MO)
Type of breach: Unauthorized Access/Disclosure
Location of breached information: Paper
Date of breach: 1/10/2011
Individuals affected: 765
Business associate involved: Coventry Health Care, Inc.
Breach report: Texas Health Arlington Memorial Hospital (TX)
Type of breach: Unknown
Location of breached information: Electronic Medical Record
Date of breach: 12/23/2010
Individuals affected: 654
The IT department turned on the switch to a BA HIE without notifying patients of the exchange or obtaining authorization.  The interface transmitted the PHI of 654 individuals. The PHI disclosed included patient names, addresses, dates of birth, social security numbers, other identifiers, diagnosis/conditions, medications, lab results, other treatment information and financial information. Following the breach, the CE revised the IT process, created a checklist that included notifying the affected departments and provided  additional training to IT and registration employees.
Breach report: NYU School of Medicine Faculty Group Practice (NY)
Type of breach: Theft
Location of breached information: Desktop Computer
Date of breach: 1/27/2011
Individuals affected: 670
An unencrypted desktop computer that contained the electronic protected health information (ePHI) of 670 individuals was stolen from the covered entity (CE), NYU Langone Medical Center.  The ePHI included names, diagnoses, the results of diagnostic tests, and clinical information.  Upon discovery of the breach, the CE filed a police report and provided breach notification to HHS, the media, and affected individuals.  As a result of OCR's investigation, the CE directed staff to store ePHI on network servers and not on desktops.  In addition, the CE improved physical security by installing a locking device to secure the desktop computer and a latch guard on the office door.  The CE retrained all staff on its policies and procedures for HIPAA and HITECH compliance.