The covered entity (CE), Oklahoma Heart Hospital, reported that four unencrypted desktop computers went missing from an area of the hospital that was under construction. This breach compromised the protected health information (PHI) of approximately 1,221 patients. The PHI involved included names, addresses, dates of birth, and clinical information. The CE notified HHS, affected individuals, and the media. In its mitigation efforts, the CE implemented additional administrative and physical safeguards and retrained its staff. OCR obtained assurances that the CE implemented the corrective actions noted.
