Charles River Medical Associates

In November 2017, Charles River Medical Associates, the covered entity (CE), discovered that an unencrypted, portable hard drive used to store monthly backups of bone density studies was missing from the bone density testing workstation, affecting 9,387 individuals. The types of protected health information (PHI) involved included patients' names, dates of birth, patients' identification numbers, and radiology images. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE applied appropriate sanctions, retrained its workforce, and conducted an audit of hardware containing electronic PHI, resulting in the replacement of two additional portable devices not in compliance with its policies. OCR reviewed the CE’s policies and procedures and obtained assurances that the CE implemented the corrective actions listed above.