Humana Inc

On July 3, 2018, the covered entity’s (CE) sale associate experienced a theft when a briefcase was stolen from a vehicle in Nashville, TN. The briefcase contained an encrypted laptop and, in violation of the CE's policies, a printed document containing the protected health information (PHI) of 684 individuals, including demographic information. In response to the incident, the CE transmitted a “poison pill” to the laptop, automatically locking the device and the hard drive. The CE also sanctioned the involved associate with a performance improvement plan and retrained all other sales associates on HIPAA. The CE provided breach notification to HHS, affected individuals, and the media. OCR obtained assurances that the CE implemented the corrective actions noted above.