Intervention Services

A laptop from the covered entity (CE), Intervention Services, was stolen from a workforce member’s vehicle. The electronic protected health information (ePHI) on the laptop included patient names, dates of birth, Medicaid numbers, and the names of the patients’ funding source for approximately 1,200 individuals. Upon discovering the breach, the CE filed a police report. The CE provided breach notification to HHS, affected individuals, and the media. The CE improved physical security, sanctioned the involved workforce member, and retrained staff. OCR obtained assurances that the CE implemented the corrective actions listed.