Stronghold Counseling Services

OCR opened an investigation of the covered entity (CE), Stronghold Counseling Services, after it reported that a desktop computer was missing from its facility. The computer contained protected health information (PHI) on appointments, client insurance, payments, and demographics, including social security numbers, as well as some client letters and reports. The breach affected 8,500 individuals. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE revised its procedures for encryption and implemented a risk analysis/risk management process. OCR provided technical assistance to the CE regarding the risk analysis and risk management requirements of the Security Rule and the requirements of the Breach Notification Rule.