Coastal home Respiratory

Computers containing the electronic protected health information (ePHI) of 3,440 patients were stolen from the covered entity (CE), Coastal Home Respiratory, during a burglary. The ePHI included names, addresses, phone numbers, insurance identification numbers, social security numbers, and diagnoses. The computers were password protected and the data was encoded. The CE promptly notified law enforcement and provided breach notification to affected individuals, HHS, and the media. Following the breach, the CE cancelled access passwords for patient data, and changed patient data software to a server based system that is password protected and encrypted. The CE's billing software vendor changed the CE's account numbers to prevent unauthorized access to the ePHI. The CE improved physical safeguards by installing a new alarm system. Following OCR's investigation, the CE also improved safeguards for PHI by implementing new procedures for activity reports, audit logs, and security reports.