Bay Area Pain and Wellness Center

On May 8, 2017, the covered entity (CE), Bay Area Pain and Wellness Center, discovered that its Electromyography (EMG) machine was stolen from an employee's car. A laptop computer attached to the EMG contained the electronic protected health information (ePHI) of approximately 548 patients. The ePHI included patients' names and dates of birth. The laptop was password protected but not encrypted. The CE provided breach notification to HHS, affected individuals and the media, as well as providing substitute notification. In response to the breach, the CE retrained its employees on its Privacy and Security Rule policies, encrypted employees’ laptops, and updated its Security Rule policy to prohibit employees from leaving computer and computer bags in unattended public areas. OCR provided the CE with technical assistance regarding breach notification and the Security Rule risk analysis and risk management provisions.