Berkshire Medical Center

A former employee of a business associate (BA), Ambucor Health Solutions, stole the protected health information (PHI) of the covered entity's (CE) patients that was contained in a mobile computer drive. The types of PHI involved in the breach included clinical and demographic information such as patients' names, dates of birth, diagnoses, and treatment, and affected1,745 individuals. OCR reviewed the CE's BA agreement and determined that it is compliance with the Privacy Rule. OCR obtained assurances that individuals affected by this breach were notified in accordance with the Breach Notification Rule.