Clinical Pathology Laboratories Southeast

Clinical Pathology Laboratories Southeast (CPLS), a covered entity (CE), reported that a laptop was stolen out of an employee’s car. The breach involved 19,763 individuals. The protected health information (PHI) involved included social security numbers, driver’s license numbers, financial information, medical information, and health insurance information. In response to the breach, the CE terminated the laptop’s access to its network, retrained employees, revised its security incident and mobile device policies, and adopted a number of technical safeguards including full disk encryption and remote wipe technologies. The CE provided breach notification to HHS, affected individuals, the media, and posted substitute notice on its website. OCR has obtained assurances that the CE implemented the corrective actions above.