CA Department of Developmental Services

On February 11, 2018, unknown persons broke into the covered entity's (CE) legal and audits offices, ransacked the offices and paper files, vandalized property, and started a fire that set off the building’s sprinkler system, which caused water damage to many documents and workstations. The breach affected approximately 582,174 individuals including the CE's employees. The types of protected health information (PHI) involved in the breach included billing information such as names, unique state-issued client identifier numbers, service code, units billed, service dates, amounts paid, and/or medical records. The CE, California Department of Developmental Services, provided breach notification to HHS, affected individuals, and the media and also provided substitute notice. Following the breach, the CE immediately reported the incident to law enforcement. In addition, the CE conducted a network investigation and verified that encrypted laptops stolen from the office were not accessed following the theft. As a result of this incident, the CE utilized a vendor to clean up water and smoke damage, placed a 24-hour security guard in the building, and changed employee passwords. OCR provided technical assistance to the CE on its security management process.