Sharon J. Jones, M.D.

A burglar broke into the office of the covered entity (CE) and stole 17 paper patient charts, an unencrypted desktop computer, two unencrypted laptop computers, and one encrypted computer server. The breach affected approximately 1,342 individuals’ protected health information (PHI) and included demographic, financial, and clinical information. The CE provided breach notification to HHS, affected individuals, and the media. It also established a dedicated call center to answer questions related to the incident and offered free credit monitoring to the affected individuals. Following the breach, the CE moved to a more secure locale and completed risk analyses in July 2015 and February 2016. The CE implemented a risk mitigation plan to reflect the current work environment, updated its policies and procedures on mobile devices, enhanced physical security, and trained workforce members on security awareness. OCR provided technical assistance regarding the HIPAA Security Rule and obtained assurances that the CE implemented the corrective actions listed above.