UNC Health Care System

UNC Health Care System, the covered entity (CE), reported that a computer was stolen that contained 27,113 patients’ files of a newly acquired medical practice (Burlington Dermatology). The types of protected health information (PHI) involved in the breach included names, addresses, birthdates, phone numbers, employment information, and social security information. 3,132 of the 27,113 individuals are deceased and the CE had no contact information for the next of kin or personal representatives. The CE provided breach notification to the remaining 23,981 affected individuals, HHS, and the media, and posted substitute notice on the CE’s website. As a result of this incident, and OCR’s investigation, the CE implemented new policies and procedures to limit the intake of patient files and computer systems from newly acquired medical practices and to upgrade acquired files and computer systems to comply with the CE’s security policies. OCR obtained assurances that the CE implemented the corrective actions noted above