Nova Southeastern University

On March 2, 2017, Nova Southeaster University, the covered entity (“CE”), discovered that two unencrypted portable drives were stolen from an employee’s vehicle on February 28, 2017, potentially exposing the names and clinical information of 8,690 affected individuals. The CE provided timely breach notification to HHS, to the affected individuals and to the media. At the time of the breach and currently, the CE trained its employees on its HIPAA policies and procedures, including the storage and transportation of PHI. Following the breach, the involved employee resigned, and the CE retrained its entire clinical and laboratory workforce on its security policies and best practices and also conducted updated risk analyses. OCR obtained assurances that the CE implemented the corrective actions listed above.