Maricopa Special Health Care District - Maricopa Integrated Health System

A medical resident lost an unencrypted thumb drive that contained the names, dates of birth, and clinical information or diagnoses of 633 patients selected for a chart review. The covered entity (CE), Maricopa Integrated Health System, provided breach notification to HHS, affected individuals, and the media. In response to the breach, the CE comprehensively reviewed its privacy and security practices and updated its HIPAA policies and procedures. It sanctioned and retrained the medical resident and retrained other workforce members on its HIPAA security procedures. OCR’s investigation resulted in the covered entity improving its HIPAA practices.