Emergency Room Associates doing business as Emergency Medicine Associates

Five months’ worth of hospital labels containing protected health information (PHI) were stolen from the car of a workforce member physician that was parked offsite from the covered entity (CE). The PHI was located in a locked briefcase within the car. The types of PHI involved in the breach included patients’ names, birthdates, ages, sex, and treatment facilities. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE filed a report with local law enforcement and retrained the workforce member involved. As a result of OCR’s investigation, the CE provided assurances that it conducted a full risk assessment and reviewed and updated its policies and procedures.