NOVA Chiropractic & Rehab Center

The covered entity (CE), NOVA Chiropractic and Rehabilitation Center, misplaced a mobile device within its office. The device contained the electronic protected health information (ePHI) of approximately 5,534 patients, including names, dates of birth, and addresses. The CE found no evidence that the ePHI was inappropriately used outside of the CE’s office. The CE provided breach notification to HHS, affected individuals, and the media, and posted substitute notice on its website. As a result of OCR’s investigation, the CE cleared and encrypted its thumb drives that contained ePHI. The CE improved physical safeguards by installing a new security alarm system, and updated its policy for removal of PHI from the office. OCR obtained assurances that the CE has executed business associate agreements for its email and cloud system providers.