Paul G. Klein, DPM

OCR opened an investigation of the covered entity (CE), Paul G. Klein DPM, after it reported that an encrypted and password protected laptop was stolen that contained the electronic protected health information (ePHI) of 2,500 individuals. The ePHI included names, addresses, dates of birth, social security numbers, diagnoses, lab test results, medications, medical notes, and treatment plans. Upon discovery of the breach, the CE filed a police report to recover the stolen item. As a result of OCR’s investigation, the CE provided confirmation that there was encryption software and multi-layered password protection software installed on the stolen laptop. OCR determined that the impermissible disclosure of ePHI did not constitute a breach under the HIPAA Rules and provided technical assistance to the CE regarding the requirements of the Breach Notification Rule.