Spine Specialist

The covered entity’s (CE) premises were burglarized and an unencrypted laptop computer was stolen. The laptop contained the electronic protected health information (ePHI) of 600 patients’ names, dates of birth, addresses, telephone numbers, copies of driver’s licenses, insurance information, and diagnostic reports. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE encrypted its computers, set up a cloud based electronic health record system with a two step authentication, changed its email system, performed a risk analysis and established a risk management plan. In addition, the CE improved physical security on the premises. OCR obtained assurances that the CE implemented the corrective actions listed. The CE is expected to review and revise its Privacy and Breach Notification Rules policies and procedures, its training materials, and its risk analysis and risk management plan to ensure that they identify and assess risks and reduce vulnerabilities to a reasonable and appropriate level.