Valley Plastic Surgery

The covered entity’s (CE) backup hard drive was stolen from the physician’s car, along with a camera and prescription pads. All the items were thrown aside except for the hard drive. The PHI involved in the breach consisted mainly of names and clinic notes of 4,873 individuals, while dates of birth were involved in some instances. Some photos of patients’ hands were also involved. Following the breach, the CE filed a police report. As a result of OCR’s investigation, the CE updated HIPAA policies, re-trained staff at all levels, and contracted with a third party to provide record storage service and encryption.