Brian Halevie-Goldman

Dr. Brian Halevie-Goldman, the covered entity (CE), reported a breach that occurred when two laptop computers, a laptop bag containing super-bills and receipts, disability paperwork, copies of prescriptions, lists of symptoms identified by patients, miscellaneous papers to be shredded, and blank controlled and non-controlled prescription pads, and a smart phone were stolen from the physician’s locked vehicle. The types of protected health information (PHI) involved in the breach included the full names, addresses, internal medical record numbers, credit card information, diagnosis/conditions, lab results, medications, and clinical note files for approximately 2,000 individuals. The CE provided breach notification to affected individuals, the media, and HHS, and also provided substitute notice. Following the breach, the CE immediately reported the theft to local law enforcement. In addition, the CE engaged an independent firm to implement additional protective measures. As a result of the breach, the CE purchased new office equipment and security software, created and implemented a log for equipment that travels between offices, encrypted electronic devices that store PHI, and revised policies and procedures to safeguard PHI. The CE also trained workforce members on its revised policies. OCR obtained assurances that the CE implemented the corrective actions noted above.