University of Kentucky - UK HealthCare

On May 1, 2012, an unencrypted laptop belonging to a University of Kentucky HealthCare employee was stolen after a workforce member's son borrowed it without permission, knowing the computer's password. The PHI of approximately 4,488 individuals was exposed, including medical record numbers, dates of visits, and chief complaints. The covered entity notified HHS, the media, and affected individuals, revised its HIPAA and mobile device policies, implemented risk-based security measures, and provided employee training. The responsible workforce member ultimately resigned. OCR obtained assurances that all corrective actions were completed. Location of breached info: Laptop.

University of Kentucky UK HealthCare reported to HHS OCR on 2011-11-23 a Loss affecting 878 individuals. Breached information was located on an Other Portable Electronic Device. No business associate was present. No further description was provided by HHS.

University of Kentucky - UK HealthCare reported to HHS on 2011-07-28 a Theft affecting 3,604 individuals. An unencrypted company laptop was stolen from an employee's car. The laptop contained PHI including names, dates of birth, Social Security numbers, medical record numbers, and diagnoses. In response, the CE mandated laptop encryption, provided employee training on mobile device encryption, and refresher HIPAA training. OCR obtained assurances of corrective actions.