Multilingual Psychotherapy Centers

An encrypted server was stolen from the covered entity (CE), Multilingual Psychotherapy Centers, Inc., on October 20, 2014, as a result of a break-in. The server contained the protected health information (PHI) of 3,500 individuals and included patients’ names, dates of birth, social security numbers, addresses, and Medicaid ID numbers. The CE provided notice to HHS and individuals whose information was contained in the stolen server. Following this incident, the CE increased its physical safeguards, modified its policies, and developed a plan to train its workforce specifically regarding data security breaches. OCR determined the CE had adequate policies and procedures in place for securing electronic information via encryption. Under OCR’s guidance, the CE provided media notice and altered its procedures to ensure such notification is performed in the event of a breach affecting more than 500 individuals.