The covered entity (CE), New Mexico Department of Health, experienced a breach of protected health information (PHI) affecting 561 individuals when a workforce member’s laptop computer was stolen out of her locked vehicle on October 4, 2015. The laptop contained patients’ names, dates of birth, diagnoses, and medications. The CE provided breach notification to HHS and affected individuals. As a result of this incident, the CE investigated the incident, modified procedures to ensure all information technology (IT) equipment is delivered directly to the IT department and all laptops are automatically encrypted. The CE also initiated a process to identify all laptops across the enterprise that did not have full disk encryption installed and revised its security awareness training to include protection/loss prevention of mobile devices. Additionally, the CE procured a mobile device management system and a security event and incident management solution and developed an implementation schedule for these tools. OCR obtained assurances from the CE that it implemented the actions listed above.
