The covered entity (CE), Ventura County Health Care Agency, discovered that a backpack containing documents for 1,399 patients was left at an elementary school after it was stolen from an employee’s car. All of the files were intact, and the types of protected health information (PHI) involved in the breach included names, balances owed, and internal account numbers. The CE provided breach notification to HHS, affected individuals, and the media and posted notice on its website, In response to the breach, the CE sanctioned the workforce member in question and retrained staff. The CE also provided OCR with additional documentation, specifically its HIPAA Notice of Privacy Practices Policy, as relevant to this breach investigation. Additionally, the CE provided OCR with written assurance that it provided refresher reminders to all staff members about its HIPAA Privacy policies and procedures.
