Gail Gillespie and Associates

An unecrypted laptop computer and an unecrypted desktop computer, jointly containing the electronic protected health information (ePHI) of 2,334 individuals, were stolen during a burglary. The computers contained patient names, parent names of minor patients, dates of service, addresses, phone numbers, dates of birth, social security numbers, diagnoses, prognoses, reports/evaluations/interventions, observations, recommendations, goals, medications, and confidential information relayed by parents and/or children and verbal information received from schools/doctors/agencies involved with the patient. The CE provided breach notification to HHS and affected individuals. It improved physical safeguards by purchasing a monitored alarm system. As a result of OCR’s investigation, the CE conducted a risk analysis, deployed encryption on workstations, retrained employees, and notified the media of the breach.