Memorial Sloan Kettering Cancer Center, the covered entity (CE), reported that a former employee’s personal unencrypted external computer hard drive was lost or stolen. The drive contained the protected health information (PHI) of 2,279 of the CE’s patients and included names, addresses, telephone numbers, dates of birth, medical record numbers, physician names, appointment dates, procedure type, and clinical information. The CE notified HHS, the media, and the affected individuals. Following the breach, the CE obtained assurances from the employee and his current employer that the PHI was deleted from all devices, computers and servers. The CE purchased and implemented an encryption solution to encrypt all data copied from its workstations, USB and external drives. The CE retrained employees on its HIPAA policies and procedures and reinforced its policies prohibiting the use of personal portable electronic data storage devices. During the investigation, OCR obtained assurances that the CE implemented the corrective actions. The CE is expected to conduct a risk analysis and implement a corresponding risk management plan.
