On March 26, 2015, a break-in occurred at the Tacoma, Washington branch office of Numotion, the covered entity (CE). The items stolen included five laptop computers that accessed service work orders, quotes, labor guides and delivery checklists. The breach affected 2,722 individuals' protected health information (PHI) and included names, addresses, phone numbers, and the serial numbers of customer equipment. Some documents may have also contained dates of birth, insurance policy numbers, or diagnosis codes. The stolen laptops required a password to obtain access to information. The CE provided breach notification to HHS, affected individuals, and the media. It also offered affected customers one year of free credit monitoring. The CE was able to successfully wipe the data from two of the computers via remote access. As a result of this investigation, the CE updated its password policy and completed full disk encryption of computer hard drives in all its locations. OCR provided technical assistance to the CE on conducting a compliant Security Rule risk analysis.
