A BlackBerry personal digital assistant device, which stored the protected health information (PHI) of 1,000 patients, was stolen from a workforce member. The types of PHI involved in the breach included names, birthdates, diagnoses/conditions, and other treatment information. The CE provided breach notification to HHS, affected individuals, and the media, and offered identity theft protection services to the individuals. Following the breach, the CE encrypted and password protected all its Blackberry devices. As a result of OCR’s investigation, the CE changed its Blackberry encryption policy.
