Hearing Zone

OCR opened an investigation of the covered entity (CE), The Hearing Zone, after it reported that an unencrypted laptop computer containing electronic protected health information (ePHI) in the form of demographic information (names, dates of birth) and clinical information (hearing test results) was stolen from a clinic. The breach affected 623 of the CE's patients and 556 patients from three other clinics where the CE provided audiology services pursuant to an agreement with those clinics. Upon discovering the breach, the CE filed a police report, and the police recovered the laptop a few weeks later. The CE provided breach notification to HHS, and affected individuals and offered all affected individuals credit monitoring services upon request. As a result of OCR’s investigation and substantial technical assistance, the CE provided breach notification to the media, developed written policies and procedures, implemented security awareness for its workforce, and, implemented encryption and other security measures for workstations in its network that contain or transmit ePHI.