Oceans Acquisition

A laptop computer from the covered entity (CE), Oceans Acquisition, Inc., was stolen from a workforce member’s vehicle. The electronic protected health information (ePHI) on the laptop included patients' first and last names, diagnoses, dates of treatment, dates of birth, insurance providers, and medical record numbers for approximately 659 individuals. Upon discovering the theft, the CE filed a report with the county sheriff's office. Additionally, the CE provided breach notification to HHS, affected individuals, and the media. The CE also improved safeguards, sanctioned the involved workforce member, and retrained staff. OCR obtained assurances that the CE implemented the corrective actions listed above.