Health Texas Provider Network

An unencrypted laptop possibly containing the electronic protected health information (ePHI) of 1,259 patients was stolen from an employee’s personal vehicle. The ePHI that was potentially involved in the breach included patients’ names, contact information, social security numbers, dates of birth, diagnoses, account numbers, physician names, types of procedures and services, dates of service, and health insurance information. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach the CE terminated the employee. As a result of OCR’s investigation, the CE updated its encryption policies and procedures to require and verify the encryption of computers before use, and conducted mandatory annual computer safety training.