Laboratory Corporation of America

A desktop computer tagged for destruction was stolen after hours from a facility of the covered entity (CE), Laboratory Corporation of America (LabCorp). The computer contained the electronic protected health information (ePHI)) of approximately 1,580 individuals, including clinical and demographic information, such as diagnoses, names, social security numbers, and dates of birth. The CE provided breach notification to HHS and affected individuals. The CE also notified law enforcement and initiated an internal investigation. In coordination with OCR’s investigation, the CE retrained its employees, changed the storage location of mobile devices and computers, and updated the encryption for its desktop computers.