New Dimension Group

The covered entity (“CE”), New Dimensions Group, LLC, discovered that on September 29, 2015, three unencrypted flash drives were reported missing. The breach affected 1,200 individuals, and the protected health information (PHI) that was potentially exposed included names, dates of birth, social security numbers, driver’s license numbers, and clinical information. The CE provided timely breach notification to HHS, to affected individuals, and on its website. Media notification was issued to the Duplin Times and the Star News. The CE provided free credit monitoring for the affected individuals for 12 months. In response to the breach, the CE banned the use of flash drives, developed policies and procedures for media and device controls, and updated its policies and procedures to protect patient PHI. The CE purchased new software to encrypt emails containing PHI and trained employees on its policies and procedures. OCR obtained assurances that the CE implemented the corrective actions listed above.