On September 4, 2011, a Summit Medical Group (SMG) employee’s car was burglarized, resulting in the theft of paper reports containing the protected health information (PHI) of approximately 731 of the covered entity’s (CE) patients. The PHI involved in the breach included account numbers, patients’ names, physicians’ names, names of hospitals, dates of discharge, dates of birth, names of insurance providers, and discharge diagnoses. The CE provided breach notification to HHS, the media, and affected individuals. It also offered credit monitoring services and created a customer service center to handle questions. Following the breach, the CE initiated an internal investigation, filed a police report, notified the affected physician sites of the breach, conducted a risk assessment, and adopted additional identification verification measures for affected individuals. As a result of OCR’s investigation, the CE updated its HIPAA policies and procedures and improved safeguards by encrypting laptop computers.
