Oregon's Health CO-OP

A personal laptop belonging to an Oregon Health CO-OP's employee was stolen from his unattended, locked car. The laptop was unencrypted and contained the electronic protected health information (ePHI) of approximately 14,000 individuals. The e-PHI involved in the breach was demographic information and included names, addresses, social security numbers, dates of birth, health plan identification numbers, and health plan numbers. Following the breach, the covered entity (CE) sanctioned the employee, implemented additional technical safeguards to prevent the downloading of e-PHI onto a personal electronic device, and trained its employees on these technical safeguards. OCR provided the CE with technical assistance regarding risk analysis and risk management implementation.