Murali Menon, Privacy Manager Breach

The covered entity (CE), Murali Menon and Physicians Skin and Weight Centers , reported that on November 4, 2014, an employee’s password protected laptop computer and external hard drive containing the protected health information (PHI) of 2,855 individuals were stolen from a locked vehicle. The theft was discovered within an hour and police were immediately notified. The types of PHI involved in the breach included demographic, financial and clinical information, including names, addresses, dates of birth, social security numbers, credit card/bank account numbers, claims information, and other treatment information. The CE provided breach notification to HHS, the media, and affected individuals, and provided the affected individuals one year of free credit monitoring. As a result of OCR’s investigation, the CE discontinued all use of external hard drives and encrypted all its laptops within 30 days. Additionally the CE revised its policies regarding the removal of electronic devices from the work site, re-trained staff, and provided OCR with its policies and procedures regarding the administrative, physical, and technical safeguarding of electronic PHI.