University of California, Los Angeles Health

The University of California, Los Angeles Health, the covered entity (CE), reported to OCR that on July 3, 2015, a password-protected, unencrypted laptop computer owned by the CE was stolen from an employee’s locked vehicle. The stolen computer contained electronic protected health information (ePHI), including the names, medical record numbers, diagnoses, conditions, and other treatment information of approximately 1,242 individuals. The CE immediately reported the incident to local law enforcement, but; the laptop was not recovered. The CE provided timely breach notification to individuals and the media and provided substitute notice. Following the breach and subsequent investigation, the CE sanctioned and re-trained the employee whose laptop was stolen for failing to comply with its HIPAA policies and procedures and implemented additional technical and administrative safeguards to ensure encryption of its laptops. OCR obtained assurances that the CE implemented the corrective actions above.