Seton Healthcare Family

OCR opened an investigation of the covered entity (CE), Seton Healthcare Family after it reported that on October 4, 2013, an unencrypted laptop computer that contained the electronic protected health information (ePHI) of 5,500 patients was stolen from a clinic. The ePHI included patients' names, medical record numbers, account numbers, social security numbers, dates of birth, diagnoses, immunizations, and insurance information. The CE notified HHS, affected individuals, and the media in accordance with the Breach Notification Rule and provided free credit monitoring services for one year. The CE took a number of corrective actions to prevent future breaches. It implemented a full disk encryption policy to be applied prior to deployment of new computers, updated internal processes, and retrained staff on its updated processes. The CE also sanctioned and re-trained the workforce member involved in the breach, and confirmed the same was applied to the Dell IT technician involved with system upgrades, including encryption. OCR obtained assurances that the CE implemented the corrective actions listed.