Center for Pain Management

Three laptop computers were stolen from the Rockville, MD office of the covered entity (CE), Center for Pain Management. The laptops were unencrypted and two of the devices contained the electronic protected health information (ePHI) of 5,822 individuals. The CE retained Identity Force, a firm specializing in providing mitigation services in cases of security breaches. Identity Force mailed notification letters to all affected individuals and provided identity theft insurance and credit monitoring services for one year. The CE also posted the breach notification on its website and notified the media. The CE engaged the services of an information technology firm to update its devices and computer network. OCR obtained assurances that the corrective action listed above was completed.