Union County Board of Developmental Disabilities

On October 23, 2010, an unencrypted laptop computer containing the protected health information (PHI) of 1,420 individuals with disabilities served by the covered entity (CE), Union County Board of Developmental Disabilities, was stolen from a service consultant’s car. The laptop contained names, dates of birth, social security numbers, Medicare/Medicaid numbers, addresses, behavior plans, diagnoses, guardianship information, phone numbers, email addresses, parents’ names, dates of eligibility, case notes, third party insurance information, and current living arrangements. The CE provided breach notification to HHS, affected individuals, and the media. The CE also reported the theft to the proper authorities, who later recovered the laptop. Following the breach, the CE encrypted its laptops and retrained staff. As a result of OCR’s investigation, the CE implemented written HIPAA policies and procedures, including uses and disclosures, safeguarding PHI/ and electronic PHI, and breach notification policies and procedures. The CE provided documentation substantiating all actions taken.