NEW YORKHHS OCRFirst filing
Filed May 22, 2015bd_731fa826b7ecfbf4
University of Rochester Medical Center and Affiliates reported to HHS OCR on 2015-05-22 an Unauthorized Access/Disclosure affecting 3,403 individuals via loss of an unencrypted flash drive (2013) and theft of an unencrypted laptop (2017). OCR found URMC failed to implement encryption and risk analysis. URMC agreed to pay $3 million and undertook a corrective action plan with two years of HIPAA compliance monitoring.
Affected (this filing): 3,403
HHS notified