Access Counseling

Access Counselling LLC, the covered entity (the CE), reported that a laptop computer used by its sole employee was stolen from his vehicle, along with books and seven case files. The breach affected the protected health information (PHI) of approximately 566 individuals and included names, addresses, dates of birth, social security numbers, medications, and treatment information. The CE conducted an investigation of the breach, prepared an incident report, and notified the affected individuals, the media, and HHS. During the OCR investigation, the CE encrypted the laptop, updated its policy and procedure regarding passwords, and obtained training for the sole employee on its policies and procedures regarding HIPAA and safeguarding PHI. OCR obtained the CE’s updated risk analysis and management plan and obtained assurances that the CE implemented the corrective actions noted above.