Northstar Healthcare Acquisitions

A laptop computer containing the electronic protected health information (ePHI) of 19,898 individuals was stolen from vehicle of an employee of Equalize Revenue Cycle Management (ERCM). ERCM is a business associate (BA) of Northstar Healthcare Acquisitions, LLC, the covered entity (CE). The ePHI included insurance and treatment information and other demographic information. Upon discovering the breach, the BA informed law enforcement. The BA notified the affected individuals, provided substitute notice via its website, and media notification. The BA offered one year of free credit monitoring services to affected individuals. Following the breach, the BA adopted encryption technologies, revised policies and procedures, and conducted an updated risk analysis. The BA also sanctioned the workforce members involved and retrained employees. OCR obtained assurances that the BA implemented the corrective action listed above. OCR also verified that the CE had a proper BA agreement in place, which restricted the BA’s use and disclosure of PHI and required the BA to safeguard all PHI.