Our Lady of the Lake Regional Medical Center

A physician’s personally owned laptop computer, which was used to conduct business on behalf of the covered entity (CE), Our Lady of the Lake Regional Medical Center, was either misplaced or stolen. The laptop contained the electronic protected health information (ePHI) of 17,339 individuals and included patients’ names, ages, dates and times of admission/discharge, race, health coverage, medical history, and results of ICU treatments. The CE provided breach notification to HHS, affected individuals, established a call center, and employed a service to provide identity protection services. As a result of OCR’s investigation, the CE established and finalized controls and policies on personally owned devices used on behalf of the CE.