Imperial Valley Family Care Medical Group, APC

On March 21, 2015, the covered entity (CE), Imperial Valley Family Care Medical Group, APC, discovered that a laptop computer was stolen when an unknown individual broken into a physician’s office. The stolen laptop contained the protected health information (PHI) of approximately 649 individuals and included members’ names, addresses, social security numbers, dates of birth and clinical information. Following the breach, the CE disabled access to its network server by the stolen laptop. The CE provided notification to HHS, affected individuals, and the media pursuant to the Breach Notification Rule and offered the affected individuals one year of free credit monitoring. Following the breach, the CE encrypted all of its company-issued laptops. OCR obtained assurances that the CE improved physical safeguards, revised its encryption policy, and strengthened its password requirements for electronic systems or devices containing electronic PHI.