Kinetorehab Physical Therapy, PLLC

The covered entity (CE) reported that an unencrypted laptop computer was stolen when it was left outside the office in an unattended bag. The laptop contained the electronic protected health information (ePHI) of 665 patients’ names, dates of birth, addresses, social security numbers, and physical therapy/clinical notes. The CE provided breach notification to HHS, the affected individuals, and the media. Following the breach, the CE installed encryption software and a security cable lock on its replacement computer to prevent another theft. OCR obtained assurances that the CE implemented the corrective actions listed above. Additionally, the CE is expected to review and revise its HIPAA policies and procedures and training materials and train all workforce members. It is also expected to perform a thorough and accurate risk analysis that addresses all potential risks and vulnerabilities in the entire operation with respect to the uses and disclosures of ePHI and develop and implement a risk management plan that addresses the process for managing and reducing the risks identified in the risk analysis to a reasonable and appropriate level.