OREGONHHS OCRFirst filing
Filed Jul 28, 2013bd_dce23c74a90d65e9
Oregon Health & Science University (OHSU) reported to HHS OCR on 2013-07-28 an Unauthorized Access/Disclosure affecting 1,361 individuals. Breached ePHI was stored on a cloud-based server without a business associate agreement. OCR's investigation—triggered by multiple breach reports including unencrypted laptops and a stolen thumb drive—found widespread HIPAA compliance failures. OHSU settled for $2,700,000 and agreed to a three-year corrective action plan. Sensitive diagnostic information of 1,361 individuals was at significant risk of harm.
Affected (this filing): 1,361
HHS notified