Ladies First Choice

In January, 2014, the covered entity (CE), Ladies First Choice Inc., learned that a former employee took and misappropriated a confidential computer program that contained customers’ demographic and healthcare information. The computer program contained the electronic protected health information (ePHI) of 2,365 individuals and included names, dates of birth, social security numbers, addresses, and identifying codes. The CE provided breach notification to HHS, affected individuals, and the media. As a result of the breach, the CE identified the vulnerabilities that contributed to the theft, re-trained its staff, reviewed all of its safeguards policies and internal procedures, including its incident reporting policies, and performed a new risk analysis. OCR obtained assurances that the CE implemented the corrective actions listed above. The CE also created new security features for its computer systems, including encryption and secure back up of PHI stored on hard drives. Additionally, the CE filed a civil action against the former employee to enjoin her from using the PHI she obtained.