Indiana University

An unencrypted and password protected laptop computer was stolen from the car of an employee (medical resident) of the covered entity (CE). The laptop contained the electronic protected health information (ePHI) of approximately 3,266 individuals. The types of ePHI in the breach included names, medical record numbers, birth dates, diagnosis codes, and social security numbers. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE audited the employee’s department and equipment, retrained the involved employee and other staff, updated its HIPAA policies and procedures, and encrypted its laptop computers. OCR obtained written assurances that the CE implemented the corrective actions listed above.