California Pacific Orthopaedics and Sports Medicine

The covered entity (CE), California Pacific Orthopaedics and Sports Medicine, reported that an unencrypted laptop and documents that contained electronic protected health information (ePHI) and protected health information (PHI) were stolen from a physician’s vehicle. The unencrypted laptop was password protected and contained the electronic protected health information (ePHI) of approximately 2,271 individuals. The PHI and ePHI involved included names birthdates, addresses, Social Security numbers, diagnoses, and other treatment information. The CE notified HHS, affected individuals, law enforcement, and the media. In response to the breach, the CE strengthened its administrative, technical, and security safeguards to better protect its PHI and ePHI. OCR provided technical assistance to the CE regarding the HIPAA Security Rule.