Georgia Health Sciences University

On January 19, 2012, the covered entity’s (CE) employee discovered that her laptop computer was stolen from the front porch of her home. The laptop contained the electronic protected health information (ePHI) of 513 patients, including names, dates of birth, and health data. The laptop lacked virtual private network connectivity and the data was password protected but not encrypted. The CE provided breach notification to HHS, affected individuals, and the media. In response to the breach, the CE encrypted all employee laptops, implemented a mobile device and remote access policy and updated its electronic data backup policy. The CE also trained staff on its HIPAA Privacy and Security policies. Additionally, the CE counseled the employee for failure to maintain physical security of the CE’s property. OCR obtained assurances that the CE implemented the corrective actions listed above.