Yadkinville Chiropractic DCPA

On February 1, 2013, the back door to the covered entity’s (CE) facility was pried open and its unencrypted desktop computer was stolen. Due to the theft, the protected health information (PHI) of 1,000 individuals was potentially exposed, including names, dates of birth, and social security numbers. The CE provided timely breach notification to HHS, affected individuals, and the media, and posted substitute notice in the lobby of its facility. In response to the breach, the CE replaced the back door, upgraded its security system, and installed cameras. The CE updated its billing software and on October 30, 2014, the CE was sold and effectively ceased operations. OCR obtained assurances that the CE implemented the corrective actions listed above.