Oregon Health and Science University

HHS OCR imposed a $200,000 civil monetary penalty on Oregon Health & Science University for failing to provide timely access to patient medical records as required by the HIPAA Privacy Rule's Right of Access provisions. OHSU did not contest the penalty.

Oregon Health & Science University (OHSU) settled potential HIPAA Privacy and Security Rules violations following an OCR investigation that found widespread problems. The settlement requires a $2,700,000 payment and a three-year corrective action plan.

Oregon Health & Science University (OHSU) reported to HHS OCR on 2013-07-28 an Unauthorized Access/Disclosure affecting 1,361 individuals. Breached ePHI was stored on a cloud-based server without a business associate agreement. OCR's investigation—triggered by multiple breach reports including unencrypted laptops and a stolen thumb drive—found widespread HIPAA compliance failures. OHSU settled for $2,700,000 and agreed to a three-year corrective action plan. Sensitive diagnostic information of 1,361 individuals was at significant risk of harm.

Oregon Health & Science University reported to HHS on 2013-04-11 a Theft affecting 1076 individuals. Breached information located on Laptop.

Oregon Health & Science University reported to HHS on 2013-03-26 a Theft affecting 1114 individuals. Breached information located on Laptop. The settlement included a $2,700,000 payment and a three-year corrective action plan addressing widespread HIPAA compliance vulnerabilities, including lack of encryption and missing business associate agreements.

Oregon Health & Science University reported to HHS OCR on 2012-07-31 a Theft breach affecting 702 individuals. Breached information was located on Other (unspecified) media. No business associate was present. No further description was provided.