ScortonAI/Cyber-Security-Breaches huggingface dataset:
Breach report: Rainbow Hospice and Palliative Care (IL)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 4/12/2010
Individuals affected: 1000
An employee's laptop was stolen out of her bag while she was making an admission visit in a patient's home.  The evidence showed that although the covered entity had a policy of encrypting and password-protecting its computers, this particular computer did not require a password most of the time.  The invoices contained the protected health information (PHI) of approximately 1,000 individuals.  The PHI stored on the laptop included names, addresses, dates of birth, phone numbers, Social Security numbers, Medicare numbers, electronic health records and commercial insurance information.  Following the breach, the covered entity notified its clients of the incident, placed notice on its website and in The Daily Herald, sanctioned the employee for changing the security settings on the laptop in question, and established stringent computer security guidelines, and retrained its staff in the new requirements, with the intention of preventing a similar event from occurring again.
Breach report: Cincinnati Childrens Hospital Medical Center  (OH)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 3/27/2010
Individuals affected: 60998
Breach report: Occupational Health Partners (KS)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 5/12/2010
Individuals affected: 1105
Breach report: AvMed, Inc. (FL)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 12/10/2009
Individuals affected: 1220000
Two laptop computers with questionable encryption (each containing the electronic protected health information (ePHI) of 350,000 individuals) were stolen from the covered entity's (CE) premises.  The types of ePHI involved included demographic and clinical information, diagnoses/conditions, medications, lab results, and other treatment data.  After discovering the breach, the CE reported the theft to law enforcement and worked with the local police to recover the laptops.  As a result of OCR's investigation, the CE developed and implemented new policies and procedures to comply with the Security Rule.  The CE also provided breach notification to all affected individuals, HHS, and the media and placed an accounting of disclosures in the medical records of all affected individuals.
Breach report: UnitedHealth Group health plan single affiliated covered entity (MN)
Type of breach: Other
Location of breached information: Paper
Date of breach: 1/26/2010
Individuals affected: 16291
Paper correspondence to certain members in UnitedHealth's prescription drug plans were in advertently sent to the incorrect temporary address due to a database administration error.  Approximately 16,291 individuals were affected by the breach. UnitedHealth member's name, plan number and in some instances, date of birth and/or limited medical information. United Health reported that it stopped using PDI's proprietary database for address updates and made outbound verifications calls to members to get accurate temporary addresses.   United Health reported that it revised its address update process.
Breach report: Lincoln Medical and Mental Health Center (NY)
Type of breach: Theft
Location of breached information: Other
Date of breach: 3/24/2010
Individuals affected: 130495
Business associate involved: Siemens Medical Solutions, USA, Inc
The covered entity's business associate (BA), Siemens Medical Solutions USA, Inc., shipped seven unencrypted compact disks (CDs) that contained the electronic protected health information (ePHI) of 130,495 individuals to the covered entity (CE), Lincoln Medical and Mental Health Center.  The CD's, containing back-up data, were lost in transit.  The ePHI included names, addresses, social security numbers, medical record numbers, health plan information, dates of birth, dates of admission and discharge, diagnostic and procedural codes, and driver's license numbers.  The CE provided breach notification to affected individuals, HHS, and the media.  Upon discovery of the breach, the CE directed the BA to cease using the shipping service as a means of transporting the CDs.  As a result of OCR's investigation, the BA adopted a procedure to encrypt CDs.  The CE also implemented a procedure for a senior employee of the BA to physically deliver the encrypted CDs to the CE.  The breach incident involved a BA and occurred prior to the September 23, 2013, compliance date.  OCR verified that the CE had a proper BA agreement in place that restricted the BA's use and disclosure of PHI and required the BA to safeguard all PHI.
Breach report: Nihal Saran, MD  (MI)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 5/2/2010
Individuals affected: 2300
A password protected laptop computer containing protected health information (PHI) was stolen from Dr. Saran's personal residence.  The laptop contained the PHI of approximately 2,300 individuals.  The PHI stored on the laptop included patients' names, addresses, dates of birth, Social Security numbers, insurance information, and diagnoses.  Following the breach, Dr. Saran notified the Northville Township Police Department of the theft, contacted the individuals reasonably believed to have been affected by the breach, sent a notice of the breach to the Detroit Free Press and the Monroe News, and installed encryption software for its billing software.
Breach report: University of Louisville Research Foundation, Inc., DBA The Kidney Disease Program (KY)
Type of breach: Hacking/IT Incident
Location of breached information: Network Server
Date of breach: 10/1/2008
Individuals affected: 708
Breach report: St. Jude Children's Research Hospital (TN)
Type of breach: Loss
Location of breached information: Laptop
Date of breach: 4/19/2010
Individuals affected: 1745
Breach report: TennCare (TN)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 3/20/2010
Individuals affected: 10515
Business associate involved: DentaQuest
A car containing an unencrypted laptop computer was stolen from West Monroe Partners, a contractor for the covered entity's (CE) business associate (BA), DentaQuest.  The laptop stored a database containing the electronic protected health information (ePHI) of approximately 76,000 individuals, including data on 10,515 of the CE's members.  The types of PHI involved in the breach included names, social security numbers, dates, and certain provider identification numbers.  The CE and BA worked together to provide breach notification to affected individuals and the media, and offered free credit monitoring and enhanced credit services to affected individuals for one year. The CE reported the breach to HHS and provided substitute notification on its website.  The BA implemented procedures to ensure that any third party laptops connecting to its network employ disk encryption.  Further, the BA established a policy to prohibit contractors from storing PHI on laptops.  The breach incident involved a BA and occurred prior to the September 23, 2013, compliance date.  OCR verified that the CE had a proper BA agreement in place that restricted the BA's use and disclosure of PHI and required the BA to safeguard all PHI.
Breach report: The Children's Medical Center of Dayton (OH)
Type of breach: Other
Location of breached information: E-mail
Date of breach: 4/22/2010
Individuals affected: 1001
Breach report: Comprehensive Care Management Corporation (NY)
Type of breach: Theft
Location of breached information: Laptop, Desktop Computer, Network Server, E-mail
Date of breach: 4/30/2010
Individuals affected: 1020
OCR opened an investigation of the covered entity (CE), Comprehensive Care Management Corporation, after it reported two former employees sent emails that contained the electronic protected health information (ePHI) of 1,020 individuals to their personal email accounts to open a competitor organization.  The ePHI included names, addresses, and enrollment information.  Upon discovery of the breach, the CE conducted an internal inquiry and found that the former employees disclosed the ePHI to its competitor.  As a result of OCR's investigation, the CE replaced and strengthened external firewalls, restricted access to email websites, restricted the use of portable devices, limited the ability to upload data to external websites, and evaluated new monitor and control software for network information.  In addition, the CE provided training to all staff on its HIPAA policies and procedures.  The CE also entered into an agreement with its competitor who hired the former employees to return or destroy the ePHI.
Breach report: alma aguado md pa (TX)
Type of breach: Theft
Location of breached information: Network Server
Date of breach: 5/29/2010
Individuals affected: 600
OCR investigated the covered entity (CE) following a report that its main server and desktop computers containing the electronic protected health information (ePHI) of 600 individuals were taken from the CE's office.  The ePHI involved in the breach included patient names, addresses, dates of birth, and social security numbers.  As a result of OCR's investigation, the CE changed its privacy and security policies, retrained its employees and provided additional physical security to better safeguard patient ePHI.
Breach report: University Hospital (GA)
Type of breach: Loss
Location of breached information: Other
Date of breach: 5/7/2010
Individuals affected: 14000
Business associate involved: Augusta Data Storage, Inc
Breach report: University Health System (NV)
Type of breach: Theft
Location of breached information: Network Server
Date of breach: 6/11/2010
Individuals affected: 7526
Breach report: Sinai Hospital of Baltimore, Inc. (MD)
Type of breach: Other
Location of breached information: E-mail
Date of breach: 5/3/2010
Individuals affected: 937
Business associate involved: Aramark Healthcare Support Services, LLC
A business associate employee sent an email to multiple patients without concealing patient email addresses.  The message concerned a dietary program in which the names and email addresses were visible to all recipients.  The breach affected 937 individuals.  In response to this incident, the covered entity took steps to enforce the requirements of its business associate agreement with Aramark.  The business associate counseled the employee responsible for the breach and retrained all employees who may communicate with patients via email on the requirements of the Privacy and Security Rules as well as related policies and procedures.
Breach report: Mary M. Desch,MD/PathHealer, LTD (AZ)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 5/15/2010
Individuals affected: 5893
Breach report: Children's Hospital & Research Center at Oakland (CA)
Type of breach: Other
Location of breached information: Paper
Date of breach: 5/25/2010
Individuals affected: 1000
Breach report: Centerstone (TN)
Type of breach: Other
Location of breached information: Desktop Computer, Paper
Date of breach: 5/1/2010
Individuals affected: 1537
Breach report: California Department of Healthcare Services (CA)
Type of breach: Loss, Other
Location of breached information: Other Portable Electronic Device, Other
Date of breach: 4/29/2010
Individuals affected: 29000
Business associate involved: Care 1st Health Plan
Breach report: Long Island Consultation Center (NY)
Type of breach: Theft
Location of breached information: Other Portable Electronic Device, Other
Date of breach: 5/21/2010
Individuals affected: 800
The covered entity (CE), Long Island Consultation Center, misplaced an unencrypted portable device that contained the electronic protected health information (ePHI) of 800 individuals.  The ePHI included names, dates of birth, diagnoses, and other treatment information.  Upon discovery of the breach, the CE conducted a search for the portable device.  The CE provided breach notification to HHS, the media, and affected individuals.  As a result of OCR's investigation, the CE improved physical security.   The CE also developed and implemented a policy and procedure prohibiting use of portable media for storing ePHI and trained staff on its new policy.
Breach report: NYU Hospitals Center (NY)
Type of breach: Theft
Location of breached information: Other Portable Electronic Device
Date of breach: 5/8/2010
Individuals affected: 2563
The covered entity (CE) misplaced an unencrypted USB drive that contained the electronic protected health information (ePHI) of 2,563 individuals.  The ePHI included names, medical record numbers, ages, genders, procedures, attending physicians' names, anesthesiologists' names, types of anesthesia, times of arrival in the recovery room, and times of discharge.  Upon discovery of the breach, the CE reported the incident to internal security as a possible theft and conducted a thorough search of the perimeter.  The CE provided breach notification to HHS, the media, and affected individuals.  As a result of OCR's investigation, the CE stopped using USB drives and local desktop computers for data storage.  In addition, the CE updated physical security in the recovery room and installed data prevention software to monitor, block or encrypt mobile media used in the CE.  Further, the CE purchased encrypted USB drives for workforce members with an identified need to download and store ePHI.  The CE also revised its mobile device and portable storage media policy and retrained all workforce members on its policies.
Breach report: University of Florida (FL)
Type of breach: Other
Location of breached information: Paper
Date of breach: 5/24/2010
Individuals affected: 2047
Breach report: SunBridge Healthcare Corporation (NM)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 5/11/2010
Individuals affected: 3830
Breach report: Department of Health Care Policy & Financing (CO)
Type of breach: Theft
Location of breached information: Desktop Computer
Date of breach: 5/17/2010
Individuals affected: 105470
Business associate involved: Governor's Office of Information Technology
Breach report: Prince William County Community Services (CS) (VA)
Type of breach: Theft
Location of breached information: Other Portable Electronic Device
Date of breach: 6/18/2010
Individuals affected: 669
Breach report: E. Brooks Wilkins Family Medicine, PA (NC)
Type of breach: Theft
Location of breached information: Desktop Computer, Other
Date of breach: 2/1/2010
Individuals affected: 13000
The breach report indicated that former employees took protected health information (PHI) pertaining to 13,000 patients and disclosed it to a competing medical practice.  The PHI included the names and contact information for the patients.  Following the breach, the entity terminated the employees who impermissibly used and disclosed the PHI. OCR also confirmed that the entity complied with the provisions of the Breach Notification Rule and notified the affected individuals.  Additionally, the entity retrained its staff regarding the policies and procedures for safeguarding of PHI.
Breach report: John Deere Health Benefit Plan for Wage Employees (IL)
Type of breach: Other
Location of breached information: Paper
Date of breach: 6/24/2010
Individuals affected: 1097
Business associate involved: UnitedHealthcare Insurance Company
Breach report: South Shore Hospital (MA)
Type of breach: Loss
Location of breached information: Other Portable Electronic Device, Other, Electronic Medical Record
Date of breach: 2/26/2010
Individuals affected: 800000
Business associate involved: Iron Mountain Data Products, Inc. (now known as
Breach report: Montefiore Medical Center (NY)
Type of breach: Theft
Location of breached information: Desktop Computer
Date of breach: 5/22/2010
Individuals affected: 16820
Two unencrypted desktop computers containing the electronic protected health information (ePHI) of 16,820 individuals were stolen from the covered entity (CE).  The ePHI included medical record numbers, dates of birth, admission /discharge dates, billing codes, and social security numbers.  Upon discovery of the breach, the CE filed a police report and provided breach notification to HHS, the media, and affected individuals.  It also provide substitute notification by posting on its website.  As a result of OCR's investigation, the CE replaced its building alarm and installed bars on the windows.  In addition, the CE directed its staff to save patient data only on a centralized network drive, moved all ePHI stored on desktop hard drives to centralized secured network servers, and encrypted all of its computers.   The CE also revised its policy and procedure on password management and provided training to all staff on its new policy.
Breach report: DC Chartered Health Plan, Inc (DC)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 5/26/2010
Individuals affected: 540
Breach report: Montefiore Medical Center (NY)
Type of breach: Theft
Location of breached information: Desktop Computer
Date of breach: 6/9/2010
Individuals affected: 23753
OCR opened an investigation of the covered entity (CE), Montefiore Medical Center, after it reported three unencrypted desktop computers were stolen that contained the electronic protected health information (ePHI) of 23,753 individuals.  The ePHI included names, medical record numbers, dates of birth, parent or guardian contact numbers, asthma diagnoses, vaccination information, and number of visits to the school health clinic.  Upon discovery of the breach, the CE filed a police report and provided breach notification to affected individuals, HHS, and the media.  As a result of OCR's investigation, the CE updated its building alarm to include additional motion sensors and installed surveillance cameras.  Further, the CE encrypted all of its computers, advised that no ePHI is stored on desktop hard drives, removed all ePHI from its computers, and stored ePHI on the centralized secured network servers.  The CE also revised its policy and procedure on password management and provided training to all staff on its new policy.
Breach report: Medina County OB/GYN (OH)
Type of breach: Improper Disposal
Location of breached information: Paper
Date of breach: 6/13/2010
Individuals affected: 1200
Breach report: The University of Texas at Arlington (TX)
Type of breach: Hacking/IT Incident
Location of breached information: Network Server
Date of breach: 2/19/2009
Individuals affected: 27000
A file server at the Office of Health Services was compromised and impermissibly accessed.  The compromise potentially exposed the prescription records of 27,000 individuals to an unauthorized source.  The protected health information involved in the breach included names, addresses diagnostic codes, name of medication prescribed, medication costs and some social security numbers.  Following the discovery of the breach, UTA removed the server from the network, notified the affected individuals and notified local media.  Following the breach, the covered entity also replaced the operating system and implemented additional technical safeguards.
Breach report: Aetna (CT)
Type of breach: Improper Disposal
Location of breached information: Paper
Date of breach: 3/29/2010
Individuals affected: 6372
Breach report: Charles Mitchell MD (TX)
Type of breach: Theft
Location of breached information: Desktop Computer
Date of breach: 6/27/2010
Individuals affected: 6873
A burglary occurred at the covered entity's (CE) facility and two desktop computers containing protected health information (PHI) were stolen.  Approximately 6873 individuals were affected.  The PHI involved included names, addresses, dates of birth, social security numbers, diagnoses and conditions, medications, and other treatment information.  OCR closed this investigation after determining that the individual who reported the breach worked for a CE no longer in existence.
Breach report: Humana Inc [case 4486] (KY)
Type of breach: Other
Location of breached information: Paper
Date of breach: 6/25/2010
Individuals affected: 2631
Business associate involved: Matrix Imaging
Breach report: WellPoint, Inc. (IN)
Type of breach: Hacking/IT Incident
Location of breached information: Network Server
Date of breach: 11/3/2009
Individuals affected: 31700
Breach report: Carolina Center for Development and Rehabilitation (NC)
Type of breach: Theft
Location of breached information: Paper
Date of breach: 6/24/2010
Individuals affected: 1590
The covered entity's (CE) staff inadvertently sent twenty-three boxes containing the protected health information (PHI) of 1,590 patients to a recycling center.  The PHI included patients' full names, addresses, dates of birth, social security numbers, insurance identification numbers, driver's license numbers, diagnoses, medication information, checking and savings account numbers, credit and debit card numbers, and photographs of the patients.  Following the breach, the CE immediately took steps for the records to be returned.  The CE notified HHS, the media, and all individuals affected by the breach, and established a toll free number for patients to call for more information.  The CE cooperated with the state attorney general's investigation and suspended the responsible staff members.  Following OCR's investigation, the CE placed a record into its accounting of disclosure log for each individual affected and terminated the employment of the staff involved in the breach.  In addition, the CE revised its policies and procedures regarding the rights of individuals and safeguards for PHI, and re-trained staff.
Breach report: Trinity Health Corporation Welfare Benefit Plan (MI)
Type of breach: Loss
Location of breached information: Other
Date of breach: 3/29/2010
Individuals affected: 1073
Business associate involved: Mercer
Breach report: Texas Children's Hospital (TX)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 5/13/2010
Individuals affected: 694
Breach report: Baylor College of Medicine (TX)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 5/13/2010
Individuals affected: 1646
An unencrypted laptop containing electronic protected health information (ePHI) of approximately 1,618 individuals was stolen from the covered entity's (CE) affiliate.  The ePHI involved in the breach included names, medical reconciliation numbers, dates of service, diagnoses, and dates of birth.  Upon discovery of the breach, the CE and its affiliate jointly notified the affected individuals, OCR, and the local media.  Notifications were delayed at the request of law enforcement.  Following OCR's investigation, the CE revised policies and procedures to require encryption of all mobile devices containing PHI and began encrypting all necessary devices in order to ensure reasonable safeguards.
Breach report: Wright State Physicians (OH)
Type of breach: Other
Location of breached information: Laptop
Date of breach: 6/11/2010
Individuals affected: 1309
On June 11, 2010, a laptop computer containing PHI was mistakenly discarded in the trash. The laptop computer contained the protected health information of approximately 1,309 individuals. The protected health information involved in the breach included patient full names or first initial and last name, dates of service, and in some cases, a brief description of medical condition or care. Following the breach, the covered entity submitted evidence of its progress in implementing encryption on its laptop computers in its various departments.
Breach report: Penn Treaty Network America Insurance Company  (PA)
Type of breach: Other
Location of breached information: Other
Date of breach: 6/4/2010
Individuals affected: 560
Social security numbers were inadvertently printed on the address labels in a newsletter mailing.  The mailing had 560 recipients.  The covered entity acted to mitigate the disclosure by verifying that the all mail was correctly delivered.  It also counseled the responsible employee and updated its policies and procedures.
Breach report: Aultman Hospital (OH)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 6/7/2010
Individuals affected: 13867