Indiana University School of Medicine

Indiana University School of Medicine, the covered entity (CE), reported that an employee’s vehicle was stolen along with a laptop that was inside. Also in the vehicle was multiple documents containing PHI. This breach affected 2,249 individuals and the PHI involved included names, Social Security numbers, diagnoses/conditions, and other treatment information. The CE notified HHS, affected individuals, and the media. As a result of this incident, the CE implemented additional administrative and physical security safeguards to better protect its PHI. The employee responsible was sanctioned. All staff were also trained on the safe transport of data and equipment containing sensitive data. OCR obtained assurances that the CE implemented the corrective actions noted.