U.S. HealthWorks, the covered entity (CE), experienced a breach on July 18, 2016 due to the theft of a CE-issued laptop computer and a notebook containing the laptop encryption password from an employee’s automobile. The breach involved the protected health information (PHI) of 1,400 individuals and included patients names, clinical information, visit dates, and social security numbers for some patients. The CE provided breach notification to HHS, affected individuals, and the media and also provided substitute notification. Additionally, the CE offered individuals who had their social security numbers involved in the breach one year of complimentary credit monitoring and identity theft protection services. Following the breach, the CE sanctioned the employee involved in the breach and retrained all employees on information security. OCR provided the CE with technical assistance regarding the Security Rule, including risk analysis and risk management.
