Centers Plan for Healthy Living

An unencrypted laptop computer containing the electronic protected health information (ePHI) of 6,893 beneficiaries was stolen from the covered entity’s (CE) corporate offices. The ePHI included names, addresses, dates of births, Medicare and/or Medicaid numbers. The CE provided breach notification to HHS, the affected individuals and the media. Following the breach, the CE encrypted all laptops, revised its encryption policy and procedure, retrained staff on HIPAA, terminated its contract with the cleaning service and entered into a new agreement with another cleaning service that ensured background checks of all staff. OCR obtained assurances that the CE implemented the corrective actions listed. The CE is expected to conduct a risk analysis and implement a corresponding remediation plan.