Freeport Memorial Hospital

The covered entity (CE), Freeport Memorial Hospital, reported the theft of a computer hard drive from the private office of an employee and that the device was later located at a secure non-public area of the hospital. The CE provided breach notification to HHS, the media, and the affected individuals, including the offer of free credit monitoring to the affected individuals. The CE also filed a police report regarding the incident. The number of individuals affected by the breach was 1,349. The protected health information included patients’ diagnosis/conditions, medications and other treatment information (PHI). Following the incident, the CE required users of the affected computer to change individual passwords, reviewed its safeguards, and conducted an audit, which determined that the PHI was not accessed. The CE also implemented an alert system for the records of the individuals affected by the breach, implementing additional safeguards for those records. In response to the breach, the CE also expanded its encryption program to include all electronic devices. OCR obtained verification from the CE that a complete review of its encryption process, and its information security system policies was undertaken. b