City of Detroit

The covered entity (CE), City of Detroit, reported that an unencrypted flash drive containing protected health information (PHI) had been reported missing. Subsequently, an employee located the flash drive and returned it to his/her supervisor. The breach affected 544 individuals. The PHI involved included names, dates of birth, addresses, Social Security numbers, diagnoses/conditions, lab results, medications, and other treatment information. Upon discovering the breach, the CE notified OCR, the affected individuals, and media outlets. The breach was also reported to the New Jersey State Police Cyber Crimes Unit. As a result of the breach, the CE implemented new encryption technology for mobile data storage devices. The CE also revised its policies and procedures regarding employee access to PHI and PII, and retrained its employees. OCR obtained assurances that the CE implemented the corrective actions noted above.