FEDERALHHS OCRFirst filing
Filed May 6, 2013bd_9f98d2e75a7340a1
The University of Rochester Medical Center & Affiliates reported a breach to HHS on May 6, 2013, after losing an unencrypted portable electronic device containing the protected health information of 537 individuals. An investigation by the HHS Office for Civil Rights (OCR) revealed systemic failures, including a lack of enterprise-wide risk analysis and failure to encrypt mobile devices. This incident, along with a similar one in 2017, resulted in a $3 million settlement with OCR and a mandated corrective action plan.
Affected (this filing): 537
HHS notified