Port City Operating Company, doing business as St. Joseph's Medical Center

On August 9, 2018, the covered entity (CE), discovered that hard drives for two old laboratory machine analyzers, powered down for removal and replacement, were missing. The missing hard drives contained the electronic protected health information (ePHI) of approximately 4,984 individuals, including names, dates of birth, genders, account information, lab tests performed, test results, and the names of the physicians who ordered the tests. In response to the breach incident, the CE and its business associate, (BA), searched its facilities and interviewed its staff, but were unable to recover the missing hard drives. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE ensured that its BA updated its policies and procedures and retrained workforce members. OCR obtained assurances that the CE/BA implemented the corrective actions listed above.