Blount Memorial Hospital

The covered entity (CE), Blount Memorial Hospital, reported that a laptop computer containing the electronic protected health information (ePHI) of 27,799 individuals was stolen from a workforce member's home. The ePHI involved in the breach included demographic and other financial information. The CE provided breach notification to affected individuals, HHS, and the media. Following the breach, the CE reviewed its privacy and security policies and procedures, encrypted all of its laptops, and improved its HIPAA training. As a result of OCR's investigation, OCR provided technical assistance regarding the CE's security incident procedures and risk management plan. OCR also reviewed the CE's HIPAA policies and procedures that were created or revised in response to the breach. \ \ \