Sutter Valley Medical Foundation

Sutter Medical Foundation, the covered entity (CE), reported that an encrypted laptop and a binder of paper documents were stolen from an employee’s locked vehicle. The CE determined that the subsequently recovered paper documents were intact. The protected health information (PHI) exposed included the names, dates of birth, ages, medical record numbers, primary care physicians, treating providers’ names, appointment times, visit types, and/or any needed accommodations of 613 individuals. The CE notified prominent media outlets and posted a copy of the press release on its website. Following the breach, the CE sanctioned the responsible workforce member, offered affected individuals one year of identity theft protection, and retrained its workforce members. OCR obtained assurances that the CE implemented the corrective actions listed above.