A break-in and burglary took place at the Office of Health Resources (HRA), a business associate (BA) of the covered entity (CE), the Arkansas Department of Humans Services (DHS). Two laptop computers which contained client files and the protected health information (PHI) of approximately 1,911 individuals were stolen. Following the breach, the CE improved physical safeguards, retrained workforce members, revised its HIPAA training for all employees on incident reporting procedures, and revised the Arkansas Business Associate Agreement (BAA) provisions on reporting breach incidents. Additionally, OCR’s investigation resulted in the CE’s development of a plan to survey its BAAs to assess HIPAA compliance and conduct on-site inspections.
