Raley's/Bel Air Mart/Nob Hill General Store, Inc.

On September 24, 2018, a pharmacy laptop computer containing unencrypted electronic protected health information (ePHI) was stolen from a workforce member’s locked car, affecting 10,124 individuals. The laptop contained both demographic and clinical ePHI, including names, dates of birth, diagnoses and prescription information. The covered entity (CE) provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE reset the workforce member’s password and disabled the stolen computer’s account. In response to OCR’s investigation, the CE conducted an updated risk analysis and risk management plan, implemented strengthened password formats, encrypted laptops, and revised policies.