An unencrypted laptop computer storing the electronic protected health information (ePHI) of approximately 14,623 individuals was stolen from the locked vehicle of a workforce member of Accretive Health, a business associate (BA) of the covered entity (CE), Fairview Health Services. The ePHI included individuals’ names, addresses, dates of birth, social security numbers, financial information, and clinical information. The CE provided breach notification to HHS, affected individuals, and the media. It also provided complimentary credit monitoring services to affected individuals. Following the breach, the CE investigated the root cause of the breach, developed a new policy which addresses the risks associated with sharing sensitive data with third parties, and obtained assurances from the BA that it would undertake appropriate corrective actions. OCR obtained a copy of the BA agreement between the CE and the BA at the time of the breach. OCR also obtained evidence and assurances that the CE implemented the corrective actions listed.
