Dr. Trandinh

The CE reported that a physician’s personally-owned, unencrypted laptop was stolen from her residence. The laptop contained the medical records of 2,306 patients who had been seen by the physician in her solo private practice, not the CE. The medical records contained demographic information, including home addresses, social Security numbers, and clinical information, including diagnoses, treatment information, and medical history. Prior to the theft, the physician had closed her private practice and provided an electronic copy of her patient records to the CE. The CE, as custodian of the records, provided breach notification to HHS, affected individuals and the media. Following additional technical assistance provided by OCR, the CE developed a written breach policy and procedure.