University of Oklahoma Department of Urology

On October 10, 2015, the covered entity (CE), University of Oklahoma Health Sciences Center, reported a breach affecting approximately 9,300 individuals. An unencrypted laptop computer used by a former physician in the Pediatric Urology program was stolen from his vehicle. The laptop contained protected health information (PHI) including patients’ first and last names, medical record numbers, and dates of birth, and in some cases, patients’ age, physicians’ names, and diagnosis, treatment, and/or billing codes. The CE provided the required breach notifications to HHS, affected individuals, and the media. Following discovery of the incident, the CE implemented additional technical safeguards for devices containing electronic PHI and retrained workforce members regarding safeguarding PHI. The CE also revised its physician exit interview to require physicians to attest that all PHI had been removed from personally owned devices at the time of departure. OCR obtained assurances the CE implemented the corrective actions listed above.