Pathways Professional Counseling

On September 25, 2015, an employee's unencrypted, password-protected laptop computer was stolen from his vehicle. The computer contained the protected health information (PHI) of 985 patients, including addresses, names, dates of birth, clinical diagnoses, financial information, social security numbers, email addresses, physician information, health insurance information, treatment information, and medication information. The CE, Pathways Professional Counseling, provided breach notification to HHS, affected individuals, and the media. In response to this breach, the CE engaged a third party to encrypt its computers and retrain employees who may use, disclose, or access PHI. It also revised its HIPAA Compliance Plan, implemented a policy requiring encryption for mobile devices before access is granted, and implemented a policy requiring reasonable security measures when employees use their own electronic devices. The CE also sanctioned the employee involved in the breach. OCR obtained assurances that the CE implemented the corrective actions listed above.