Wolf & Yun

On April 24, 2012, a password protected laptop computer containing patient demographic information and auditory diagnostic testing data was stolen during office hours from a back laboratory testing room of the covered entity (CE), Wolf and Yun. The breach affected approximately 824 individuals. The electronic protected health information (ePHI) on the laptop included patients’ names, addresses, dates of birth, and raw auditory testing data. The CE provided breach notification to HHS, affected individuals and the media. Following the breach, the CE filed a police report, reviewed its policies and procedures and improved physical safeguards. As a result of OCR’s investigation, the CE performed a risk analysis, installed a secure router, increased transmission security, revised its HIPAA policies, updated its computer operating system, created formal incident response and reporting procedures, and retrained its workforce.