Metcare of Florida

The covered entity (CE), Metcare of Florida, discovered on May 2, 2012, that its facility had been broken into and a tablet computer was stolen. The tablet was password protected but not encrypted and contained the following types of protected health information (PHI): patients’ name, dates of birth, patient identification numbers, and clinical information. The theft affected 2,557 individuals. The CE provided breach notification to HHS, affected individuals, and the media and posted substitute notice on its website. In response to the breach, the CE encrypted its portable devices, implemented written policies requiring the physical safeguard of portable devices, and provided specialized training to its workforce. OCR obtained assurances that the CE implemented the corrective actions listed above.