Oneida Tribe of Indians of Wisconsin

The covered entity (CE), Oneida Tribe of Indians of Wisconsin, reported an employee’s personal flash drive containing the electronic protected health information (ePHI) approximately 2,734 individuals was stolen from its dental offices. The ePHI involved in the breach included names, patient identification numbers, dental insurance plan numbers and dates of service. Following the breach, the CE sanctioned and retrained the employees involved in the breach. Also, the CE notified employees that it banned the use of all external electronic data storage devices, unless they are encrypted and approved by the CE. As a result of OCR’s investigation, the CE updated its policy related to Breach Rule Notification and distributed the updated policy to its workforce. OCR obtained documented assurances that it implemented the corrective actions listed above.