Childrens Hospital of Los Angeles

The covered entity (CE), Children’s Hospital of Los Angeles, reported a breach of 3,594 individuals’ electronic protected health information (ePHI) resulting from theft of an unencrypted laptop stored in a workforce member’s vehicle while parked in a public parking lot. The breach affected patients' demographic information (name, date of birth, medical record number, address) and/or clinical information. Following the breach and in response to OCR’s contact in this matter, the CE took corrective actions, including blocking the laptop from accessing the CE's internal computer network, reminding staff not to store laptops or other mobile devices in vehicles, ensuring encryption on each Apple operated laptop, and implementing new policies. The CE provided breach notification to HHS, affected individuals, and the media.