Children's Hospital Medical Center of Akron

The covered entity (CE) reported that a hard drive was missing that contained approximately 1,800 hours of voice recordings that were communications between dispatchers and medical staff prior to or during medical transport between September 18, 2014, and June 3, 2015. The hard drive was not searchable without a separate application and many of the recordings did not contain protected health information The hard drive was missing from the CE's locked, secure area. The breach affected 7,664 individuals and included clinical and demographic information. The CE provided breach notification to HHS, affected individuals, and the media. Upon discovery of the breach, the CE installed a security camera in the area the hard drive was located, ceased storing back-up transport voice recordings on a mobile device, encrypted all mobile devices, and retrained staff. OCR obtained documentation that the CE implemented the compliance actions listed.