University of California, San Francisco

On September 25, 2013, a personal laptop computer containing electronic protected health information (ePHI), and paper documents containing PHI, were stolen out of a physician’s locked car, affecting 8,294 individuals. The stolen laptop contained unencrypted ePHI, including patients’ names, addresses, social security numbers, dates of birth, diagnoses, conditions, lab results, medications, and other treatment related-ePHI. The covered entity (CE), University of California San Francisco, provided breach notification to HHS, affected individuals, and the media. In response to the breach, the CE updated its policy on safeguarding ePHI to specifically address personally owned electronic devices, including the requirement that they be encrypted, and that ePHI transported offsite must stay within the direct possession of the workforce member. OCR obtained written assurances that the CE implemented the corrective actions listed above.