On March 2, 2017, Nova Southeaster University, the covered entity (“CE”), discovered that two unencrypted portable drives were stolen from an employee’s vehicle on February 28, 2017, potentially exposing the names and clinical information of 8,690 affected individuals. The CE provided timely breach notification to HHS, to the affected individuals and to the media. At the time of the breach and currently, the CE trained its employees on its HIPAA policies and procedures, including the storage and transportation of PHI. Following the breach, the involved employee resigned, and the CE retrained its entire clinical and laboratory workforce on its security policies and best practices and also conducted updated risk analyses. OCR obtained assurances that the CE implemented the corrective actions listed above.
What is known
People affected
4,681 (as reported by the organization)
Disclosed
May 2, 2017
Discovered
Dec 12, 2018
Happened
Sep 1, 2018
Attack
Lost or stolen device
Data exposed
Names, Social Security numbers, Government IDs, Health
2026-09-25 · attack: unknown to lost-device · backfill source
2026-09-25 · data_types: ["names","ssn","government-id"] to ["names","ssn","government-id","health"] · backfill source
2026-09-25 · disclosed: 2018-03-09 to 2017-05-02 · backfill source
2026-09-25 · summary: empty to On March 2, 2017, Nova Southeaster University, the covered entity (“CE”), discovered that two unencrypted portable drives were stolen from an employee’s vehicle on February 28, 2017, potentially exposing the names and clinical information o · backfill source
2026-09-25 · data_types: ["names","ssn"] to ["names","ssn","government-id"] · backfill source
2026-09-25 · discovered: empty to 2018-12-12 · backfill source
2026-09-25 · data_types: [] to ["names","ssn"] · backfill source
2026-09-25 · disclosed: 2019-01-25 to 2018-03-09 · backfill source
