HP Enterprise Services, LLC

HP Enterprise Services, LLC, a business associate (BA) of the Indiana Family Social Services Administration, reported the theft of a laptop bag from an employee’s vehicle. The bag contained an encrypted laptop computer and an unsecured printed report which contained the protected health information (PHI) of 1,235 individuals. The PHI included demographic information. The BA provided breach notification to HHS, affected individuals, and the media and offered the affected individuals free credit monitoring services. Following the breach, the BA sanctioned the employee responsible for the breach in accordance with its sanction policy. As a result of OCR’s investigation, the BA updated its policies and procedures to prevent similar incidents. As a result of OCR's investigation, OCR provided technical assistance regarding breach notification requirements and the BA revised its breach notification template.