Loma Linda University School of Dentistry

Three password protected desktop computers and an auxiliary hard drive containing electronic protected health information (ePHI) was stolen from the covered entity (CE), Redlands Periodontal Group, Loma Linda University School of Dentistry. The ePHI involved in the breach included the demographic information of 10,100 individuals. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, The CE conducted an on-site audit of the periodontal clinic and conducted a risk assessment of the 16 clinics under the purview of the School of Dentistry. The CE improved safeguards by replacing the clinic’s computers with computers that do not contain local hard drive storage, issuing remote access credentials, relocating paper patient charts, and deactivating access to network resources from the periodontal facility. It also decommissioned associated equipment and networks, and disposed of computing equipment used in conjunction with daily operations at the periodontal facility. In addition, the CE retrained staff regarding its HIPAA policies and procedures. OCR obtained assurances that the CE implemented the corrective actions listed.