A laptop computer belonging to an employee of the covered entity (CE), Memphis Pathology Laboratory d/b/a American Esoteric Laboratory, was stolen on October 15, 2017. The laptop contained emails about billing processes, including patient names, addresses, dates of birth, Social Security numbers, diagnoses, names of tests completed, codes for tests completed, insurance claims information, and financial information for 67,895 individuals. In response to this incident and as a result of OCR’s investigation, the CE reviewed and revised its security incident response process, implemented several technical and administrative security improvements, and sanctioned the employee involved. The CE also provided breach notification to HHS, affected individuals, the media, and on its website. OCR obtained assurances that the CE implemented the corrective actions listed above.
