David S. Ng, O.D.

On June 16, 2018, the covered entity (CE), Dr. David Ng, reported that an unidentified individual broke into his office and stole a number of items, including a portable computer drive (i.e., a USB thumb drive). The stolen drive contained protected health information (PHI), including names, addresses, dates of birth, social security numbers, health claim information, and medical records relating to 758 patients. The CE provided breach notification to HHS, affected individuals, and the media and offered identity theft protection services to the affected individuals. In response to the breach, the CE changed all relevant passwords, adopted an encrypted storage method for patient’s PHI, and retrained workforce members. The CE also provided OCR with additional documentation including its HIPAA Notice of Privacy Practices policy, as relevant to this breach investigation. OCR obtained assurances that the CE implemented the corrective actions listed above.