Concentra

An unencrypted laptop computer containing the electronic protected health information (ePHI) of approximately 900 patients was stolen from one of the covered entity's (CE) facilities. The ePHI included demographic and clinical data. Following the breach, the CE filed a police report and notified affected patients, HHS and the media. Following OCR's investigation, the CE required all business units to identify any devices that contain PHI and revised procedures for future computer purchases. The CE also implemented physical and technical safeguards for all testing devices that contain ePHI and replaced outdated machines that could not be encrypted. Additionally, the CE revised existing physician agreements to disallow the use of equipment containing ePHI that is not encrypted. OCR obtained assurances that the CE implemented the corrective action listed above. \ \