Abrham Tekola, M.D

Two unencrypted desktop computers and one unencrypted laptop computer were stolen during a burglary. The breach affected 5,471 individuals and the types of protected health information (PHI) involved included patients’ names, social security numbers, addresses, dates of births, and medical information. Upon learning of the theft, the covered entity (CE) hired a legal firm to assist with responding and notifying all individuals affected. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE hired specialized data security personnel, conducted a Security Rule risk analysis, and implemented a risk mitigation plan that reflects the current work environment. Additionally, the CE improved safeguards by updating its policies and procedures on portable/mobile devices and encrypting its electronic equipment. The CE completed security awareness training of its workforce members. OCR obtained documentation that the CE implemented the corrective actions noted above and provided technical assistance regarding the HIPAA Security Rule.