Colorado Neurodiagnostics

An unencrypted laptop computer containing protected health information (PHI) was stolen from Colorado Neurodiagnostics’ locked offices on April 25, 2014, affecting approximately 750 individuals. The PHI on the laptop included patients’ names, dates of birth, diagnoses, conditions, laboratory results, medications, and treatment information. The covered entity (CE) provided breach notification to affected individuals, the media, and HHS. It also immediately filed a police report and implemented additional physical safeguards. As a result of OCR’s investigation and technical assistance, the CE conducted a risk analysis, developed a risk management plan, encrypted its electronic devices containing PHI, and implemented additional technical safeguards.