A laptop computer was stolen from a hospital employee’s vehicle. The computer contained the protected health information (PHI) of 943 individuals and included names, contact information, dates of birth, social security numbers, medical record numbers, and health insurance information including diagnosis codes and billing code descriptions. The CE provided breach notification to HHS, affected individuals, and the media. In response to this incident, the CE accelerated and completed implementation of a pre-existing plan to encrypt all hospital laptops. Additionally, the CE revised its information security policies and retrained its workforce. OCR obtained assurances that the CE implemented the corrective actions listed above.
