The Johns Hopkins Hospital

On October 10, 2015, the covered entity (CE), Johns Hopkins Hospital, reported that a physician’s unencrypted laptop computer storing the electronic protected health information (ePHI) of 571 individuals was stolen at an international airport with all of her belongings. The types of ePHI contained in the laptop included physicians' names, patients' names, medical record numbers, and clinical information. The CE provided breach notification to HHS, the media, affected individuals, and offered credit monitoring. The CE sanctioned the physician involved in accordance with the CE's HIPAA sanctions policy. The CE also circulated a broadcast reminder to its workforce members of their existing policy requiring all devices that contain or may contain PHI to be encrypted and password protected. OCR obtained assurances that any of the CE's portable devices that stores ePHI is required to use the CE's encryption program. Additionally, the CE submitted a copy of its most recent risk analysis and risk management program to OCR. They also provided OCR with information related to their new encryption program that would inform a user when he or she is out of compliance and send them to a website that would refer them to local IT administration. OCR obtained assurances that the CE implemented the corrective actions listed.