Diversified Resources

On August 11, 2011, a password protected, but unencrypted laptop computer was stolen from a nurse’s car. The laptop contained the electronic protected health information (ePHI) of 863 individuals. The ePHI on the laptop included names, addresses, phone numbers, primary care physicians, caregiver contacts, and social security numbers. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, CE reviewed its policies and procedures, applied employee sanctions, retrained its workforce, and implemented file-level encryption. Pursuant to technical assistance provided by OCR, CE implemented additional administrative safeguards, including a new policy prohibiting employees from leaving laptops unattended in a vehicle.