Compassionate Care Hospice of Central Louisiana

Ten encrypted laptop computers and one external hard drive containing the electronic protected health information (ePHI) of approximately 707 individuals were stolen from the covered entity (CE), Compassionate Care Hospice of Central Louisiana. The laptops contained two reports. The first report listed the names, ages, admitting and discharge dates, location, medication class and other items related to 120 patients. The second report contained the names of 97 patients. The hard drive contained one file, a bereavement report listing the names, addresses, phone numbers and date of death of deceased patients. The CE provided breach notification to HHS, affected individuals and the media. Following the breach, the CE remotely wiped the stolen laptops. Additionally, it inventoried and assessed devices and equipment containing ePHI and brought them into compliance with the CE’s policies, including encryption requirements. OCR obtained a copy of the CE's current risk analysis and risk management plan with evidence of implementation for security measures, including evidence of security measures to reduce the risk of computer theft.