Associates In EyeCare, P.S.C.

An office of the covered entity (CE), Associates in EyeCare, P.S.C., was broken into and two laptop computers and an external hard drive were stolen. The breach affected 971 individuals and the types of protected health information (PHI) involved in the breach included patients’ names, internal account numbers, optical images, technical information about the images, and dates of birth. The CE provided timely breach notification to HHS, affected individuals, and the media. The CE also posted notification about the breach to its website. In response to the breach, the CE changed the exterior locks on the clinic doors, revised its policies for moving laptops between offices, began saving all patient information to the cloud, and equipped its new laptop with encryption and physical security. Further, CE revised its security policies. OCR obtained assurances that the CE will train its employees on its updated policies.