SynerMed / Inland Valleys IPA

On April 14, 2013, a SynerMed employee’s laptop computer was stolen out of her vehicle while parked in front of her home. The laptop contained the protected health information (PHI) of 3,164 individuals, and included patients’ names, member identification, dates of service, reasons for visits, and procedure codes. The laptop was password protected, but was not encrypted. The covered entity (CE) provided breach notification to HHS, affected individuals, and the media, and posted substitute notice on its website. In response to this incident, the CE improved physical security, encrypted all computers, counseled the employee involved, and trained staff. It also reviewed its policies and implemented an encryption policy. OCR obtained assurances that the CE implemented the corrective actions listed above.