Ortho Montana, PSC

A laptop containing the electronic protected health information (ePHI) of approximately 37,000 patients was lost or stolen when the laptop was taken to an event by a workforce member. Following the breach, the covered entity (CE) sanctioned the workforce member who responsible for handling the laptop. As a result of OCR's investigation, the CE conducted a risk analysis and developed a risk management plan. The CE also removed ePHI from laptops and encrypted laptops, tablets, and cellular smart phones. Additionally, the CE developed new procedures and revised existing procedures in order to safeguard ePHI .