HealthSouth Rehabilitation Hospital of Round Rock

The CE reported that an employee’s unencrypted laptop computer was stolen from a vehicle. The CE determined that the laptop, which was password-protected, potentially included local copies of e-mails containing individuals’ names, addresses, dates of birth, social security numbers, phone numbers, insurance numbers, diagnoses, referral identification numbers or medical record numbers. The CE provided breach notification to HHS, affected individuals, and the media. At the time of the incident, the CE was in the process of acquiring another facility and encrypting laptops owned by the facility. In response to the breach, the CE took additional steps to locate and secure any other remaining laptops owned by the facility it was acquiring. Further, the CE implemented additional technical safeguards to prevent similar breaches and sanctioned the involved workforce member. OCR obtained assurances that the CE implemented the corrective actions listed above.