Coplin Health Systems

On December 29, 2017, the covered entity (CE), Coplin Health System, reported that a password-protect, unencrypted laptop computer issued to a part-time employee was stolen from his automobile. The employee notified law enforcement and the CE immediately notified its information technology (IT) department of the theft. Further inquiry determined that the employee did not store protected health information (PHI) on the laptop, but used it to access and use the CE’s online Electronic Health Record (EHR) system and email system. The CE could not eliminate the risk that the laptop could have contained some PHI saved by prior users. At the time of the theft, the CE had an encryption policy in place requiring all laptops issued to employees to be encrypted. The CE immediately cancelled the credentials issued to the employee that enabled him to access its IT systems, including the EHR system. The CE’s IT department monitored its’ IT systems for any signs of unauthorized access and is expected to do so indefinitely. The CE counseled the employee policies and procedures with regard to security for laptops. Following the breach, the CE ensured that every laptop in its inventory was either en