Kent Center

A briefcase containing paper documents including the protected health information (PHI) of approximately 1,361 individuals was stolen from an employee’s car. The types of PHI involved in the breach included clients’ names, dates of birth, and for a small number of clients, limited clinical information. The covered entity (CE), The Kent Center, provided breach notification to affected individuals, the media, and HHS. Following the breach, the CE sanctioned the employee involved, revised its confidentiality policy related to safeguarding client lists, and re-trained its employees. Additionally, as a result of OCR’s investigation the CE revised and updated its breach notification policies and reinforced the requirements of the Privacy and Breach Rules to its employees.