The covered entity (CE), Harris County Hospital District dba Harris Health System, reported that an employee lost two envelopes containing the protected health information (PHI) of 2,298 individuals. The PHI involved included names, addresses, birthdates, Social Security numbers, diagnoses, medications prescribed, and other treatment information. The CE notified HHS, affected individuals, the media, and provided substitute notice. In its mitigation efforts, the CE implemented additional administrative and physical safeguards to prevent future incidents of this nature.
What is known
People affected
5,357 (as reported to HHS)
Disclosed
Feb 27, 2020
Discovered
Feb 10, 2021
Happened
Jan 4, 2011
Attack
Insider
Data exposed
Names, Health, Social Security numbers, Insurance, Dates of birth, Addresses
2026-09-25 · disclosed: 2025-10-03 to 2020-02-27 · backfill source
2026-09-25 · summary: empty to The covered entity (CE), Harris County Hospital District dba Harris Health System, reported that an employee lost two envelopes containing the protected health information (PHI) of 2,298 individuals. The PHI involved included names, address · backfill source
2026-09-25 · data_types: ["names","health"] to ["names","health","ssn","insurance","dob","addresses"] · backfill source
2026-09-25 · discovered: empty to 2021-02-10 · backfill source
2026-09-25 · occurred: empty to 2011-01-04 · backfill source
