Ronald Schubert MD

A covered entity (CE) physician’s car was broken into while parked in a public non-work location and an unencrypted laptop computer under the seat was stolen. The electronic protected health information (ePHI) involved in the breach included addresses, birth dates, social security numbers and clinical information in password-protected electronic medical record software and affected 950 individuals. The CE filed a police report and notified practice partners. Breach notification was provided to HHS, affected individuals, and the media. Following the breach, the CE improved safeguards by encrypting all devices and media that store, access or transmit ePHI. As a result of OCR’s investigation, OCR provided technical assistance and the CE implemented a policy to formalize the procedures for safeguarding mobile devices.