Southwest Virginia Physicians for Women

An employee’s husband, who was also a contractor of the covered entity (CE), Southwest Virginia Physicians for Women, stole protected health information (PHI) from its office, obtaining access to paper charts and other records. The PHI involved in the breach included clinical information affecting approximately 568 individuals. The CE, with the help of the Virginia State Police, retrieved the PHI the day after it was stolen. The CE provided breach notification to HHS, affected individuals, and the media, and posted substitute notification on its website. Following the breach, the CE transitioned from paper to electronic charts and updated its login, logoff, and password policies and procedures for authorized users of its online record management system. The CE also updated its policies regarding required business associate agreements. As a result of OCR’s investigation, the CE completed a risk analysis, implemented new physical security procedures, and retrained its staff regarding the changes