Comprehensive Psychological Services

On October 28, 2013, the covered entity’s (CE) facility was broken into and an unencrypted laptop was stolen, affecting the demographic and clinical information of approximately 3,500 individuals. The CE provided breach notification to HHS, affected individuals, and the media. The CE increased its facility’s physical security. The CE also upgraded its technology and improved safeguards by encrypting equipment and communication containing ePHI, implementing a networked file server and domain, and backing up client data to an encrypted cloud-based storage service. Pursuant to OCR’s recommendations, the CE modified its policies and training procedures.