Eastern Maine Medical Center

The covered entity (CE), Eastern Maine Medical Center, reported the loss of an unencrypted external computer hard drive, affecting 660 individuals. The types of protected health information (PHI) involved in the breach included patients’ names, dates of birth, dates of service, medical record numbers, procedures, physicians’ names, and locations. OCR’s investigation revealed that the external hard drive was attached to a medical imaging computer that was solely accessed and used by a business associate (BA), Biosense Webster, Inc. The CE provided breach notification to HHS, affected individuals, and the media and also offered all affected individuals one free year of identity protection services. OCR reviewed a copy of the executed BA agreement that complied with the Privacy and Security Rules. Following the breach, the CE improved security within the area where the hard drive was located and mitigated risks associated with the system. The CE also re-examined its medical devices across the organization to assess potential vulnerabilities with equipment controlled by BAs, as well as other potential security concerns. As a result of OCR’s investigation, the CE created an updated Risk Management Plan, implemented new technical safeguards, improved physical security, and retrained staff.