The University of Texas MD Anderson Cancer Center

The University of Texas MD Anderson Cancer Center reported to HHS OCR on 2014-01-31 the loss of an unencrypted thumb drive (Other Portable Electronic Device) containing ePHI of 3,598 individuals. Exposed data included names, birthdates, diagnoses, lab results, medications, and treatment information. OCR pursued formal enforcement for failure to encrypt and impermissible ePHI disclosure. An ALJ and DAB upheld a civil money penalty, but the U.S. 5th Circuit vacated it; the DAB ultimately dismissed the case. No business associate was involved.

Affected (this filing): 3,598