ABQ HealthPartners

A laptop computer was stolen from the covered entity (CE), ABQ Health Partners. The laptop contained the electronic protected health information (ePHI) of approximately 778 patients, although the CE was unable to conclusively determine which patients’ names were still on the laptop. The ePHI involved in the breach included names, dates of birth, age, sex, referring physicians’ names, and raw numeric test data of less than 778 individuals. Following the breach, the CE encrypted ePHI stored on laptops and tablet computers. As a result of OCR’s investigation, the CE obtained more information about the outdated system which held the ePHI. In addition, the CE provided OCR with a copy of their IT Security Policy in which the CE focused on compliance with the HIPAA Security Rule and HITECH Act requirements.