ScortonAI/Cyber-Security-Breaches huggingface dataset:
Breach report: Brooke Army Medical Center (TX)
Type of breach: Theft
Location of breached information: Paper
Date of breach: 10/16/2009
Individuals affected: 1000
A binder containing the protected health information (PHI) of up to 1,272 individuals was stolen from a staff member's vehicle.  The PHI included names, telephone numbers, detailed treatment notes, and possibly social security numbers.  In response to the breach, the covered entity (CE) sanctioned the workforce member and developed a new policy requiring on-call staff members to submit any information created during their shifts to the main office instead of adding it to the binder.  Following OCR's investigation, the CE notified the local media about the breach.
Breach report: Mid America Kidney Stone Association, LLC (MO)
Type of breach: Theft
Location of breached information: Network Server
Date of breach: 9/22/2009
Individuals affected: 1000
Five desktop computers containing unencrypted electronic protected health information (e-PHI) were stolen from the covered entity (CE).  Originally, the CE reported that over 500 persons were involved, but subsequent investigation showed that about 260 persons were involved.  The ePHI included demographic and financial information. The CE provided breach notification to affected individuals and HHS.  Following the breach, the CE improved physical security by installing motion detectors and alarm systems security monitoring.  It improved technical safeguards by installing enhanced antivirus and encryption software.  As a result of OCR's investigation the CE updated its computer password policy.
Breach report: Alaska Department of Health and Social Services (AK)
Type of breach: Theft
Location of breached information: Other Portable Electronic Device, Other
Date of breach: 10/12/2009
Individuals affected: 501
Breach report: Health Services for Children with Special Needs, Inc. (DC)
Type of breach: Loss
Location of breached information: Laptop
Date of breach: 10/9/2009
Individuals affected: 3800
A laptop was lost by an employee while in transit on public transportation.  The computer contained the protected health information of 3800 individuals.  The protected health information involved in the breach included names, Medicaid ID numbers, dates of birth, and primary physicians.  In response to this incident, the covered entity took steps to enforce the requirements of the Privacy & Security Rules.  The covered entity has installed encryption software on all employee computers, strengthened access controls including passwords, reviewed and updated security policies and procedures, and updated it risk assessment.  In addition, all employees received additional security training.
Breach report: L. Douglas Carlson, M.D. (CA)
Type of breach: Theft
Location of breached information: Desktop Computer
Date of breach: 9/27/2009
Individuals affected: 5257
A shared Computer that was used for backup was stolen on 9/27/09 from the reception desk area of the covered entity. The Computer contained certain electronic protected health information (ePHI) of 5,257 individuals who were patients of the CE.  The ePHI involved in the breach included names, dates of birth, and clinical information, but there were no social security numbers, financial information, addresses, phone numbers, or other ePHI in any of the reports on the disks or the hard drive on the stolen Computer. Following the breach, the covered entity notified all 5,257 affected individuals and the appropriate media; added technical safeguards of encryption for all ePHI stored on the USB flash drive or the CD used on the replacement computer; added physical safeguards by keeping new portable devices locked when not in use in a secure combination safe in doctor's private office or in a secure filing cabinet; and added administrative safeguards by requiring annual refresher retraining of CE staff for Privacy and Security Rules as well as requiring immediate retraining of cleaning staff in both Rules.
Breach report: David I. Cohen, MD (CA)
Type of breach: Theft
Location of breached information: Desktop Computer
Date of breach: 9/27/2009
Individuals affected: 857
A shared Computer that was used for backup was stolen from the reception desk area, behind a locked desk area, probably while a cleaning crew had left the main door to the building open and the door to the suite was unlocked and perhaps ajar.  The Computer contained certain electronic protected health information (ePHI) of 857 patients.  The ePHI involved in the breach included names, dates of birth, and clinical information.  Following the breach, the covered entity notified all affected individuals and the media, added technical safeguards of encryption for all ePHI stored on the USB flash drive or the CD used on the replacement computer, added physical safeguards by keeping new portable devices locked when not in use in a secure combination safe in doctor's private office or in a secure filing cabinet, and added administrative safeguards by requiring annual refresher retraining staff for Privacy and Security Rules as well as requiring immediate retraining of cleaning staff in both Rules, which has already taken place.
Breach report: Michele Del Vicario, MD (CA)
Type of breach: Theft
Location of breached information: Desktop Computer
Date of breach: 9/27/2009
Individuals affected: 6145
A shared Computer that was used for backup was stolen on 9/27/09 from the reception desk area of the covered entity.  The Computer contained certain electronic protected health information (ePHI) of 6,145 individuals who were patients of the CE, The ePHI involved in the breach included names, dates of birth, and clinical information, but there were no social security numbers, financial information, addresses, phone numbers, or other ePHI in any of the reports on the disks or the hard drive on the stolen Computer. Following the breach, the CE: notified all  6,145 affected individuals and the appropriate media;  added technical safeguards of encryption for all ePHI stored on the USB flash drive or the CD used on the replacement computer; all passwords are strong; all computers are password protected; added physical safeguards by keeping new portable devices locked when not in use in a secure combination safe in doctor's private office or in a secure filing cabinet; and added administrative safeguards by requiring annual refresher retraining of CE staff for Privacy and Security Rules as well as requiring immediate retraining of cleaning staff in both Rules, which has already taken place.
Breach report: Joseph F. Lopez, MD (CA)
Type of breach: Theft
Location of breached information: Desktop Computer
Date of breach: 9/27/2009
Individuals affected: 952
A shared Computer that was used for backup was stolen on 9/27/09. The Computer contained certain electronic protected health information (ePHI) of 952 patients. Following the breach, the covered entity notified all 952 affected individuals and the appropriate media; added technical safeguards of encryption for all ePHI stored on the USB flash drive or the CD used on the replacement computer; added physical safeguards by keeping new portable devices locked when not in use in a secure combination safe in doctor's private office or in a secure filing cabinet; and added administrative safeguards by requiring annual refresher retraining of staff for Privacy and Security Rules.
Breach report: Mark D. Lurie, MD (CA)
Type of breach: Theft
Location of breached information: Desktop Computer
Date of breach: 9/27/2009
Individuals affected: 5166
A shared Computer that was used for backup was stolen on 9/27/09 from the reception desk area of the covered entity.  The Computer contained certain electronic protected health information (ePHI) of 5,166 individuals who were patients of the CE, The ePHI involved in the breach included names, dates of birth, and clinical information, but there were no social security numbers, financial information, addresses, phone numbers, or other ePHI in any of the reports on the disks or the hard drive on the stolen Computer. Following the breach, the CE: notified all 5,166 affected indiv's and the appropriate media;  added technical safeguards of encryption for all ePHI stored on the USB flash drive or the CD used on the replacement computer; all passwords are strong; all computers are password protected; added physical safeguards by keeping new portable devices locked when not in use in a secure combination safe in doctor's private office or in a secure filing cabinet; and added administrative safeguards by requiring annual refresher retraining of CE staff for Privacy and Security Rules as well as requiring immediate retraining of cleaning staff in both Rules, which has already taken place.
Breach report: City of Hope National Medical Center (CA)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 9/27/2009
Individuals affected: 5900
A laptop computer was stolen from a workforce member's car. The laptop computer contained the protected health information of approximately 5,900 individuals. Following the breach, the covered entity encrypted all protected health information stored on lap tops.  Additionally, OCR's investigation resulted in the covered entity improving their physical safeguards and retraining employees.
Breach report: The Children's Hospital of Philadelphia (PA)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 10/20/2009
Individuals affected: 943
Breach report: Cogent Healthcare of Wisconsin, S.C. (TN)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 10/11/2009
Individuals affected: 6400
A laptop was stolen from a locked office at the Aurora St. Lukes Medical Center.  The laptop contained protected health information pertaining to 6,400 individuals.  The information included patient names, dates of birth, social security numbers, medical record numbers, and in some cases diagnosis codes.  In response to the theft, the hospital implemented several corrective action measures, including accelerated efforts to encrypt all laptop hard drives, improved physical locks on the office where the theft occurred, staff training regarding the appropriate use and storage of devices containing ePHI, and encryption of portable flash drives and Blackberry devices.
Breach report: Universal American (NY)
Type of breach: Other
Location of breached information: Paper
Date of breach: 11/12/2009
Individuals affected: 83000
Business associate involved: Democracy Data & Communications, LLC (
In its breach report and during the course of OCR's investigation, the covered entity advised that it took various corrective actions to prevent a reoccurrence of the breach.  Specifically, the covered entity conducted a risk assessment which revealed that the breach posed a significant risk of financial, reputational, or other harm to the 83,000 members.  The covered entity sent notification letters to 83,000 members apologizing for the breach and offered a year of free credit monitoring and a $25,000 insurance policy against identity theft ($10,000 for New York residents).  The covered entity also provided training to its call centers on November 29, 2009 to answer inquiries from callers concerned about the breach.  In addition, media outlets were contacted to alert of a breach in states in which more than 500 members were impacted by the breach.  The covered entity advised that media outlets were identified based on location of membership impacted, as well as ensuring it was a major media outlet and press releases were sent to 21 major media outlets on December 18, 2009.  The covered entity also created and implemented a new policy titled 'Personal Health Information and Personal Identifiable Information Data Security and Handling Policy Acknowledgement Form'  that centralized all data requests through a 'Team Track'  which is an internal electronic submission request that ensures all PHI requested data receives the sign off of the Privacy Officer and Security Officer prior to release.  Further, the covered entity also provided a mandatory annual computer-based training to all staff in May 2010.
Breach report: Kern Medical Center (CA)
Type of breach: Theft
Location of breached information: Other
Date of breach: 10/31/2009
Individuals affected: 596
Breach report: Keith W. Mann, DDS, PLLC (NC)
Type of breach: Hacking/IT Incident
Location of breached information: Desktop Computer, Network Server, Electronic Medical Record
Date of breach: 12/8/2009
Individuals affected: 2000
Business associate involved: Rick Lawson, Professional Computer Services
Breach report: Detroit Department of Health and Wellness Promotion (MI)
Type of breach: Theft
Location of breached information: Other Portable Electronic Device
Date of breach: 10/22/2009
Individuals affected: 10000
Breach report: Detroit Department of Health and Wellness Promotion (MI)
Type of breach: Theft
Location of breached information: Laptop, Desktop Computer
Date of breach: 11/26/2009
Individuals affected: 646
A desktop and four laptop computers were stolen from the covered entity's locked facility.  The protected health information involved in the breach included names, addresses, dates of birth, social security numbers, types of services received, and Medicare/Medicaid numbers.Following the breach, the covered entity installed new office door locks with assigned keys, installed security cameras with alarms, and physically secured computers to desks.  The covered entity now stores billing information in its patient management system, and it ensured that no electronic protected health information was stored locally. Additionally, OCR's investigation resulted in the covered entity providing training to workforce members regarding the incident
Breach report: University of California, San Francisco (CA)
Type of breach: Other
Location of breached information: E-mail
Date of breach: 9/22/2009
Individuals affected: 610
Breach report: Daniel J. Sigman MD PC (MA)
Type of breach: Theft
Location of breached information: Other Portable Electronic Device, Other, Electronic Medical Record
Date of breach: 12/11/2009
Individuals affected: 1860
Computer backup tapes containing EPHI for the office practice management program including electronic medical records were stolen from the home of the practice manager on December 11, 2009.   The breach affected approximately 1,860 patients. The protected health information on the tapes contained patients' names, addresses, telephone numbers, dates of birth, insurance information, social security numbers and medical record information.  Following the breach, Sigman took the following voluntary corrective actions: (1) upgraded software application for backup security; implemented a new external backup system in case the server goes down; (2) encryption software was implemented for data contained on both its backup tapes and network storage device; (3) revised its security policy for transporting backup media; backup tapes must now be stored in a lockbox within a locked office in its facility; the revised policy also prohibits the movement of backup tapes from the facility as well as restricts access to the tapes to designated workforce; (4) employees were retrained on the policies and procedures in place and received training on the new policies and procedures for safeguarding backup tapes; (5) notified affected individuals and the media.
Breach report: Massachusetts Eye and Ear Infirmary (MA)
Type of breach: Theft
Location of breached information: Other
Date of breach: 11/10/2009
Individuals affected: 1076
Breach report: BlueCross BlueShield Association (DC)
Type of breach: Theft
Location of breached information: Paper
Date of breach: 10/26/2009
Individuals affected: 3400
Business associate involved: Service Benefits Plan Administrative Services Corp
The covered entity's (CE) business associate (BA) incorrectly updated contract holders' addresses and mailed protected health information (PHI) to the wrong address of approximately 3,400 individuals.  The PHI involved included demographic information, explanations of benefits, clinical information, and diagnoses.  The breach incident involved a BA and occurred prior to the September 23, 2013, compliance date.  Upon discovery of the breach, the CE obtained assurances that the BA took steps to enforce the requirements of the BA agreement.  Specifically, the BA updated its processes and created an incident tracking report.  In addition, a contract was executed for a new vendor to handle mail address verification. Following OCR's investigation, the BA improved its code review process to catch the system error that caused this incident and instituted a manual quality review process.  OCR verified that the CE had a proper BA agreement in place that restricted the BA's use and disclosure of PHI and required the BA to safeguard all PHI.
Breach report: BlueCross BlueShield Association (DC)
Type of breach: Theft
Location of breached information: Paper
Date of breach: 10/7/2009
Individuals affected: 15000
Business associate involved: Merkle Direct Marketing
The covered entity's (CE) business associate (BA) mailed protected health information (PHI) of approximately 15,000 individuals to incorrect addresses due to an error in its quarterly address update process.  The mailing contained demographic information, explanations of benefits, clinical information, and diagnoses. Upon discovery of the breach, the CE collected the returned mail and verified that it had not been delivered, and updated its HIPAA policies and procedures. Following OCR's investigation, the CE was able to recover all or nearly all of the misdirected envelopes.
Breach report: Kaiser Permanente Medical Care Program (CA)
Type of breach: Theft
Location of breached information: Other Portable Electronic Device, Other
Date of breach: 12/1/2009
Individuals affected: 15500
Breach report: Blue Island Radiology Consultants (IL)
Type of breach: Theft
Location of breached information: Other
Date of breach: 12/9/2009
Individuals affected: 2562
Business associate involved: United Micro Data
The covered entity's (CE's) business associate (BA) mailed a package to the CE that was supposed to contain a backup data tape and compact disc containing protected health information (PHI); however, the tape was not in the package when delivered.  Approximately 2,000 individuals were affected by the breach. The PHI included demographic, financial, and clinical information.  The CE provided breach notification to affected individuals, HHS, and the media.  Following the breach, the CE revised its procedures for back up data storage instead of sending tapes via the mail.  Following OCR's investigation, the CE continued to reevaluate ways to enhance administrative, physical, and technical safeguards.
Breach report: Goodwill Industries of Greater Grand Rapids, Inc. (MI)
Type of breach: Theft
Location of breached information: Other
Date of breach: 12/15/2009
Individuals affected: 10000
On December 15, 2009, a safe was stolen from Goodwill's off-site facility, which contained five unencrypted back-up tapes.  The breach affected approximately 10,000 individuals.  The protected health information involved in the breach included full names, addresses, dates of birth, reasons for referral, dates of service, miscellaneous demographics, and, in some cases, Social Security numbers.  The covered entity moved the off-site storage of back-up tapes to a new site controlled by Goodwill.  The tapes are now kept in a commercial grade safe with a combination lock.  The actions taken by Goodwill prior to OCR's formal investigation brought the covered entity into compliance.
Breach report: Children's Medical Center of Dallas (TX)
Type of breach: Loss
Location of breached information: Other Portable Electronic Device, Other
Date of breach: 11/19/2009
Individuals affected: 3800
Breach report: Concentra (TX)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 11/19/2009
Individuals affected: 900
Breach report: Ashley and Gray DDS (MO)
Type of breach: Theft
Location of breached information: Desktop Computer
Date of breach: 1/10/2010
Individuals affected: 9309
Breach report: Advocate Health Care (IL)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 11/24/2009
Individuals affected: 812
On November 24, 2009, an Advocate nurse's laptop computer was stolen.  The missing laptop computer contained the protected health information of approximately 812 individuals.  The protected health information involved in the breach included name, address, dates of birth, social security numbers, insurance information, medication, and diagnoses. Following the breach, Advocate specifically addressed mobile device security and accepted use. Additionally, OCR's investigation resulted in Advocate workforce members that use mobile devices are now required to fill out and submit an acknowledgment form that establish proper administrative, technical, and physical security safeguards.
Breach report: The Methodist Hospital (TX)
Type of breach: Theft
Location of breached information: Other
Date of breach: 1/18/2010
Individuals affected: 689
An unencrypted laptop computer was stolen from the covered entity's unlocked testing office.  The laptop computer contained the protected health information of approximately 689 individuals.  The protected health information involved in the breach included names, dates of birth, Social Security numbers, and the age, gender, race, and medication information of affected individuals.  Following the breach, the covered entity restricted the storage of electronic protected health information to network drives.  Additionally, OCR's investigation resulted in the covered entity improving their physical safeguards and in retraining employees.
Breach report: University of California, San Francisco (CA)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 11/30/2009
Individuals affected: 7300
Breach report: Carle Clinic Association (IL)
Type of breach: Theft
Location of breached information: Other, Paper
Date of breach: 1/13/2010
Individuals affected: 1300
Breach report: Educators Mutual Insurance Association of Utah  (UT)
Type of breach: Theft
Location of breached information: Other
Date of breach: 12/27/2009
Individuals affected: 5700
Business associate involved: Health Behavior Innovations (HBI)
Breach report: University Medical Center of Southern Nevada (NV)
Type of breach: Theft
Location of breached information: Paper
Date of breach: 10/31/2009
Individuals affected: 5103
Between the dates of July 31, 2009 and November 19, 2009, a former UMC volunteer faxed patient face sheets to an attorney who used the sheets to contact prospective clients.  Although UMC only had proof of two disclosures, it chose to notify all 5,301 individuals that could have been affected by the breach.  The protected health information involved in the breach included names, addresses, dates of birth, social security numbers, and diagnoses.  Following the breach, UMC conducted an internal investigation, notified all 5,301 individuals, notified the media, and notified the Secretary.  Additionally, UMC reformulated face sheets so that they no longer include full social security numbers and provided all possible affected individuals with a year of free credit monitoring.  As a result of this breach, at least one person has been indicted on one count of conspiracy to illegally disclose personal health information in violation of the HIPAA
Breach report: Center for Neurosciences (AZ)
Type of breach: Theft
Location of breached information: Laptop
Date of breach: 12/15/2009
Individuals affected: 1100