Brevard Physician Associates

The covered entity (CE), Brevard Physician Associates, reported a breach when three computers were stolen from its facility. One of the computers contained protected health information (PHI) for 7,976 individuals. The PHI included names, clinical information, and insurance information. The CE provided breach notification to HHS, affected individuals, media, and posted substitute notice on its website. During the course of the investigation, the CE initiated procedures to remotely wipe the contents of the stolen computer’s hard drives once they connect to the Internet. The CE pledged to begin encrypting data at rest on all of their computers. The CE also installed a number of additional physical safeguards such as surveillance cameras and locks to deter and prevent unauthorized access. OCR obtained the policies and procedures from the CE concerning its access controls, and other administrative, physical and technical safeguards.