Hospice Care Plus

The covered entity (CE), Hospice Care Plus, Inc., reported that an employee left a company laptop containing the electronic protected health information (ePHI) of 2,033 individuals at a previous home. The ePHI involved included names, addresses, birthdates, diagnoses, medications prescribed, clinical information, and other treatment information. The CE notified HHS, affected individuals, the media, and provided substitute notice. In its mitigation efforts, the CE sanctioned management and the employee. The CE also implemented additional technical and security safeguards and retrained its staff. OCR obtained assurances that the CE implemented the aforementioned corrective actions.