Valley Mental Health

On February 27, 2013, Valley Mental Health, the covered entity (CE), discovered that a computer hard drive had been stolen from one of its facilities. The computer was located in a common area and available for use by members. The hard drive contained protected health information (PHI)—members' names, diagnostic and treatment information, financial records, media release forms, members' photographs, activity sign-up sheets, and resumes—for approximately 700 individuals. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach and during OCR’s investigation, the CE posted signs reminding members that information stored on shared computers is not confidential, encrypted hard drives, and stored PHI in locked offices and locked file cabinets. OCR obtained assurances that the CE implemented the corrective actions listed above, and OCR provided the CE with technical assistance regarding its Security Rule obligations.