South Bend Orthopaedic Associates

The covered entity (CE), South Bend Orthopaedic Associates, reported that on July 22, 2017, an unencrypted laptop computer containing protected health information (PHI) was stolen from an employee’s car. This breach affected approximately 1,272 individuals and the types of PHI involved in the breach included patients' names, genders, dates of birth, referring physicians, patient’s EMG waveforms, and dates of tests. The CE reported the theft to the police and provided breach notification to HHS, affected individuals, and the media, and also provided substitute notification. Following the breach, the CE encrypted all devices that store electronic PHI. As a result of OCR’s investigation, the CE created more robust policies and procedures for safeguarding PHI, uses and disclosures of PHI, mobile devices, and breach notification. The CE also implemented policies and procedures to safeguard mobile devices which contain PHI while traveling and trained its workforce on its updated policies. OCR obtained documented assurances that the CE implemented the corrective actions noted above.