In April 2014, the covered entity (CE), Healthy Connections Inc., reported that an unencrypted mobile computer drive containing patients' electronic protected health information (ePHI) was lost in transit between the CE and another CE. The breach was noticed when the other CE received the envelope minus the flash drive in the mail. The breach affected the demographic and clinical information of 793 individuals. The CE provided breach notification to HHS, affected individuals, and the media. As a result of OCR's investigation, the CE conducted a comprehensive system-wide risk analysis, implemented a risk management plan, and enhanced its entire electronic and technical security system. OCR obtained assurances that the CE implemented the corrective actions noted above.
