Chesapeake Regional Medical Center

The covered entity (CE), Chesapeake Regional Medical Center, reported that two external computer hard drives were stolen from its Sleep Center. The breach included the protected health information (PHI) of 2,111 individuals and included names, dates of birth, medical record numbers, and clinical information. OCR reviewed the covered entity’s policies to ensure compliance with the Privacy and Security Rules. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE implemented additional physical safeguards and conducted a new assessment of all external storage devices. OCR obtained assurances that the CE implemented the corrective actions listed above.