OptumHealth New Mexico

On September 26, 2016, the covered entity (CE), Optum, learned that an unencrypted portable computer drive (a "USB flash drive") containing the electronic protected health information (ePHI) of approximately 2,006 individuals had been lost or accidentally destroyed within the U.S. Postal Service System after being mailed on September 16, 2016 by Optum’s business associate (BA) Rothstein, Donatelli, Hughes, Dahlstrom, Schoenburg & Bienvenu (a law firm). The ePHI consisted of names, addresses, dates of birth, providers' names, diagnoses, plan ID, as well as partial or full social security numbers for 169 of the individuals. The CE's BA Agreement with the law firm is compliant with the Privacy Rule. As of January 1, 2017, the CE ceased engaging new business with the BA. OCR obtained documentation of this corrective action. OCR is opening a separate review of the BA.