RSC Insurance Brokerage, Inc.

RSC Insurance Brokerage, Inc., a business associate (BA), filed a breach report on behalf of nine covered entities following the theft of a BA workforce member’s backpack containing an unencrypted laptop computer, affecting 19,893 individuals. The types of protected health information (PHI) involved included demographic, clinical, and health claims information. The BA provided breach notification to the covered entities and, at the covered entities’ requests, to the affected individuals, the media, and HHS. Following the breach, the BA replaced the workforce member’s laptop with an encrypted laptop, confirmed that encryption is in place on all other existing devices, revised its policies and procedures, and provided retraining on cyber security to all workforce members. OCR provided technical assistance to the BA concerning the timing of its breach notifications, and the BA agreed to revise its policies and procedures accordingly.