University of California, San Francisco

On September 9, 2013, both an unencrypted personal laptop computer containing electronic protected health information (ePHI) and paper documents that contained PHI were stolen out of a workforce member’s locked car. The laptop contained unencrypted ePHI pertaining to 3,541 individuals, and the paper documents contained PHI for 31 patients. The types of PHI involved in the breach included patients’ names, addresses, dates of birth, medical record numbers, social security numbers, diagnoses, conditions, dates of service, lab results, medications, and other treatment-related PHI. The covered entity (CE), the University of California San Francisco, provided breach notification to HHS, affected individuals, and the media. Following the breach the CE retrained the workforce members on encryption, use of email on personal devices, and best practices for sharing PHI documents via email. OCR obtained assurances that the CE implemented the corrective actions noted above.