Kaiser Permanente Medical Care Program

An unencrypted portable hard drive containing the electronic protected health information (ePHI) of approximately 15,500 individuals was stolen from the vehicle of the covered entity's (CE) employee. The ePHI involved in the breach included names, medical record numbers, and treatment information. A subset of records may also have included dates of birth, age, gender, and phone numbers. Following the breach, the responsible employee was terminated for violating the CE's policies. OCR obtained assurances of the CE's policies and procedures for safeguarding ePHI and verification that the CE provided breach notification to affected individuals, the media, and HHS. In addition, the CE deployed encryption software for removable media.