RMA Medical Centers of Florida

RMA Medical Centers of Florida, the covered entity (CE), discovered that on February 6, 2016, a password protected company laptop computer was stolen from an employee’s hotel room. The laptop was not encrypted. It contained 3,906 individuals’ protected health information (PHI) and included patients’ names, dates of birth, health plan identification numbers, diagnoses, and primary care physicians’ names. The CE provided breach notification to HHS, affected individuals, and the media and posted substitute notice on its website. It also offered complimentary one-year identity theft protection to affected individuals. Following the breach, the CE encrypted all laptops containing PHI and revised certain HIPAA policies to improve safeguards. The CE educated and retrained its employees on its policies. Finally, the CE sanctioned the employee responsible for the breach. OCR obtained assurances that the CE implemented the corrective actions listed above.