University of Texas Health Science Center at Houston

The covered entity (CE), The University of Texas Health Science Center at Houston, reported that documents containing protected health information (PHI) were stolen from an employee’s vehicle. This breach affected 1,792 individuals and the PHI involved included names, birthdates, diagnoses, and clinical information. The CE notified HHS, affected individuals, the media, and local law enforcement. Substitute notice was also provided. Following the incident, the CE sanctioned the responsible employee, implemented additional administrative safeguards, and retrained its employees on the importance of safeguarding PHI. OCR obtained assurances that the CE implemented the corrective actions noted.