On January 4, 2016, the covered entity (CE), Premier Healthcare, LLC, discovered that an unencrypted laptop computer had been stolen from its administrative office in Bloomington, Indiana. The breach affected 205,748 individuals and included addresses, zip codes, dates of birth, names, social security numbers, claims information, credit card and bank account information, and medical information. In March 2016, the missing laptop was returned to the CE in the mail anonymously. The CE consulted with a forensics firm which extricated the hard drive, conducted an analysis, and determined that the laptop had not been turned on and no one had accessed its contents during the time it was missing. The CE provided breach notification to HHS, affected individuals, and the media and also posted substitute notice on its website. The CE also established a toll-free telephone number for individuals to call to obtain additional information about the breach. Following the breach, the CE encrypted all of its computers, improved physical safeguards, and implemented new security procedures. OCR obtained documentation from the CE substantiating its implementation of the corrective actions listed above
