Karen Kietzman

A laptop, iPad, and portable memory drive were stolen from the office of Dr. Karen Kietzman, the covered entity (CE), affecting approximately 708 individuals. The electronic protected health information (ePHI) contained on the devices included patients’ demographic and mental health information. The CE provided breach notification to HHS, affected individuals, and media. As a result of the breach, and to prevent a recurrence, the CE improved physical safeguards, encrypted her laptop, and stopped storing ePHI on any other electronic media. As a result of OCR’s investigation and technical assistance, the CE developed a risk analysis and risk management plan and developed policies and procedures to implement the Privacy, Security, and Breach Notification Rules.