Barry University

Barry University, the covered entity (CE), discovered on May 13, 2013, that a laptop was infected with malware. The protected health information (PHI) for 8,741 individuals was potentially exposed, including names, dates of birth, social security numbers, driver’s license numbers, banking/credit card information, medical record numbers, health insurance information, diagnoses, and treatment information. Due to a lengthy investigation, the CE performed its breach notification obligations outside of the 60 day timeframe required by the Breach Notification Rule. OCR provided technical assistance to the CE on this topic. Although late, the CE provided breach notification to HHS, affected individuals, and the media, as well as on its website. In response to the breach, the CE retained a compliance consultant, performed a risk assessment, revised its policies and procedures, improved its training program and implemented additional technical safeguards. OCR obtained assurances that it has implemented the corrective actions listed above.