Briar Hill Management

The covered entity (CE), Briar Hill Management, discovered that an employee lost a laptop computer containing protected health information (PHI) in violation of the CE’s policy. The laptop contained the names, addresses, social security numbers, dates of birth, dates of service, prescription information, and services provided pertaining to 1,994 individuals. The CE provided breach notification to HHS, affected individuals, the media, and on its website. It also notified local police. In response to the breach, the CE sanctioned the involved employee. As a result of OCR’s investigation, the CE reviewed its security risks and implemented several new security measures, including providing additional training to employees, installing software that allows the CE to track and remove data from devices remotely, and encrypting all mobile devices. OCR obtained assurances that the CE implemented the corrective actions listed above.