Sharp Memorial Hospital

Sharp Memorial Hospital, the covered entity (CE), reported that an unencrypted laptop computer and unencrypted external hard drive used to store electronic protected health information (ePHI) were stolen from a secure storage area. The ePHI of 791 patients was stored on the hard drive at the time of the theft. The ePHI included individuals’ names, dates of birth, prescription information and family medical history. In response to the breach incident, the CE notified the affected individuals of the breach, notified prominent media outlets of the breach, ensured the presence of encryption software on all laptops and media storage devices, updated relevant policies and procedures, implemented additional administrative, physical and technical safeguards, provided retraining to workforce members in the facility where the breach occurred. As a result of the investigation, OCR stated the expectation that the CE will complete a thorough and enterprise wide risk analysis and implement a comprehensive risk management plan.