Oregon Health and Science University
ent_019e0b212bf62bc2b7deaf2a6b6e3a1c
Disclosures
3
HHS OCR · 1 jurisdiction
Incidents
—
no linked incident in sample
Max affected reported
1,361
as filed · HHS OCR OR
Leak-site claims
0
none in sample
Identity resolution
- Canonical name
- Oregon Health and Science University
- Normalized
- oregon health and science university— dedupe via name-norm; Microsoft / MSFT collapse to one row
- GLEIF LEI
- 549300XTWOAGON8L2G98
- SEC EDGAR CIK
- None — not an SEC registrant
- Domain
- ohsu.edu
Disclosure history (3)newest first
- OREGONHHS OCRas victim2013-07-28
Oregon Health & Science University (OHSU) reported to HHS OCR on 2013-07-28 an Unauthorized Access/Disclosure affecting 1,361 individuals. Breached ePHI was stored on a cloud-based server without a business associate agreement. OCR's investigation—triggered by multiple breach reports including unencrypted laptops and a stolen thumb drive—found widespread HIPAA compliance failures. OHSU settled for $2,700,000 and agreed to a three-year corrective action plan. Sensitive diagnostic information of 1,361 individuals was at significant risk of harm.
- OREGONHHS OCRas victim2013-03-26
Oregon Health & Science University reported to HHS on 2013-03-26 a Theft affecting 1114 individuals. Breached information located on Laptop. The settlement included a $2,700,000 payment and a three-year corrective action plan addressing widespread HIPAA compliance vulnerabilities, including lack of encryption and missing business associate agreements.
- OREGONHHS OCRas victim2012-07-31
Oregon Health & Science University reported to HHS OCR on 2012-07-31 a Theft breach affecting 702 individuals. Breached information was located on Other (unspecified) media. No business associate was present. No further description was provided.