Three secondary back-up portable hard drives, which were maintained by the covered entity (CE), Maryville Academy, were removed from a locked room used as a secure area to maintain a secondary back-up copy of some electronic records for the CE’s services programs. The drives contained the electronic protected health information (ePHI) of approximately 3,897 individuals, including patients’ names, dates of birth, telephone numbers, social security numbers, addresses, diagnosis/conditions, financial claims information, medications, lab results, and other treatment information. The CE provided breach notification to HHS, affected individuals, and the media, and posted notification of the breach on its website. The CE also offered one year of free credit monitoring services to affected individuals. Following the breach, the CE revised its HIPAA policies and procedures and encrypted its back-up portable hard drives and other portable electronic devices. It also updated its practices regarding the physical storage of its back-up portable hard drives to include the use of a third party, off-site vendor and contracted with a third party vendor for long term offsite archive storage, and tra
