Lancaster Cardiology Medical Group, and Sunder Heart Institute and Vascular Medical Clinic

The covered entity (CE), Lancaster Cardiology Medical Group and Sunder Heart Institute & Vascular Medical Clinic, reported that sometime between June 20, 2015, and June 21, 2015, laptop computers, desktop computers, servers, and other portable electronic devices were stolen from its facility during a burglary. Approximately 2,071 individuals were affected by this breach. The types of electronic protected health information (ePHI) involved in the breach included clinical and demographic information. Following the breach, the CE promptly reported the incident to law enforcement. It provided breach notification to HHS, affected individuals, and the media. As a result of this incident, as well as OCR’s corresponding investigation, the CE implemented a plan to encrypt all ePHI stored on its devices. The CE also implemented additional physical safeguards, which included the installation of new locks and improved video surveillance. The CE updated its policies and procedures addressing administrative, technical, and physical safeguards. OCR obtained assurances that the CE implemented the corrective actions noted above.