A laptop computer and an external hard drive containing protected health information (PHI) were stolen from the University of Utah Health, Moran Eye Center, the covered entity (CE), on or about April 3, 2018. Together, the stolen equipment contained the PHI of 607 individuals, including their retinal scans, names, dates of birth, and medical record numbers. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE identified the thief, reported to the police, and upgraded physical security at the Center. As a result of the investigation, the Center developed a facility security plan, and the CE developed a team to inventory devices in clinical and administrative areas to find any that had been missed in prior inventories to ensure that all devices containing PHI were included in the CE’s security processes. OCR obtained assurances that the CE implemented the corrective actions noted above.
