Oregon Health & Science University (OHSU) has agreed to settle alleged HIPAA violations involving two separate data breaches with the Office for Civil Rights (OCR) for $2.7 million.

In the span of three months in 2013, OHSU experienced two reportable data breaches, which triggered investigations by the OCR.

The first occurred when an unencrypted laptop