California Correctional Health Care Services

The covered entity, California Correctional Health Care Services, reported that a password protected, but unencrypted laptop computer, was stolen from a workforce member’s car. The CE reported that the electronic protected health information (ePHI) consisted of custody and care information of 400,000 patients. The ePHI may have included confidential medical, mental health and custodial information. The CE issued breach notification letters to affected parties, the media, as well as OCR. As a result of the investigation, the CE implemented periodic technical and non-technical evaluations, revised policies and procedures, sanctioned the workforce member, and retrained its workforce. The CE also encrypted its laptop computers.