North Country Hospital and Health Center

A former employee of the covered entity (CE), North Country Hospital and Health Center, retained possession of a retired unencrypted laptop computer that contained protected health information (PHI) following his termination on July 15, 2013. The types of PHI involved in the breach included electronically signed physician orders with dates and ordering providers’ names, as well as patient names, demographic information and clinical information, including diagnoses. The CE provided breach notification to HHS, affected individuals, and the media. As a result of OCR’s investigation, the CE installed removable disk encryption on all of its laptops as well as desktop computers that store PHI. It also revised the computer system and risk management policy. The CE also implemented a termination checklist and a termination procedure. OCR provided technical assistance to the CE regarding risk analysis.