Baylor College of Medicine

A physician’s backpack containing five unencrypted portable data drives and a handwritten notebook with the protected health information (PHI) of approximately 1,004 pediatric patients was stolen from an automobile. The types of PHI involved in the breach included names, dates of birth, hospital medical record numbers, types of surgery performed, and treating physicians’ names. One of the drives contained surgical images of twenty patients. The breach affected approximately 876 patients of Texas Children's Hospital (TCH) and 128 patients of Memorial-Hermann. The physician, a surgical fellow for the covered entity (CE), Baylor College of Medicine, reported the theft to the police and notified TCH. TCH initiated an investigation and notified the CE of the breach on July 15, 2015. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE distributed an acknowledgment and attestation document to each medical resident and fellow addressing the CE’s patient privacy and security policies, including incident reporting procedures. Due to OCR’s involvement, all residents, fellows and learners are required to complete the acknowledgment and attestation at the beginning of each academic year. The CE also initiated a policy to require the acknowledgment and attestation to be included in each graduate medical education program participant’s contract at the beginning of each academic year.