IntraCare North Hospital

A former employee of the covered entity (CE), Intracare North Hospital, stole computers, monitors, and the CE’s billing software. The protected health information (PHI) involved in the breach included names, addresses, phone numbers, dates of birth, insurance information, and social security numbers. The District Attorney’s Office has not provided the CE with the PHI nor have they provided the CE with the number of patients that were affected. The CE provided breach notification to HHS, the media, and affected individuals. Individual notification included a toll-free number and the Harris County District Attorney’s contact number. Following OCR’s investigation, the CE improved safeguards by upgrading its system to allow for more specific monitoring of the activity of users and creating user codes to track copier use. The CE also improved administrative safeguards by revising workforce clearance procedures for certain jobs, and improved physical safeguards by installing surveillance cameras. In addition, staff was re-trained on the HIPAA Rules.