Sunquest Information Systems

The covered entity (CE), Sunquest Information Systems, reported that on July 27, 2015, that an unencrypted laptop computer was stolen from a workforce member’s car. The CE determined that the breach affected the electronic protected health information (ePHI) associated with approximately 2,100 individuals. The types of ePHI affected by the breach included patients’ addresses, dates of birth, names, social security numbers, medical record numbers, health insurance information, billing codes, diagnosis information and lab results. The CE provided breach notification to HHS, affected individuals and the media, and offered 1 year of free credit monitoring to affected individuals. Following the breach, the CE sanctioned the responsible workforce member and provided additional training to other workforce members. As a result of OCR’s investigation, the CE implemented encryption technology and updated relevant policies and procedures.