Lindsay House Surgery Center

A nurse anesthetist’s bag was stolen from her car, and among the contents of the bag were papers containing the protected health information (PHI) of 772 patients of the covered entity (CE), Lindsay House Surgery Center, LLC. The CE reported that the PHI included patients’ names, ages, medical procedures, dates of service, dates of birth, phone numbers, insurance information and social security numbers. The CE provided breach notification to HHS, the media, and the affected individuals, and posted notice on its website. Following the breach, the CE re-trained its workforce members, including the nurse anesthetists, on HIPAA. The CE also implemented new processes to enable the nurse anesthetists to view electronic PHI securely in the covered entity’s system, and prohibited the nurse anesthetists from removing paper records containing PHI from the CE. OCR obtained assurances that the CE implemented the corrective actions listed above.