Senior Health Partners, a Healthfirst company

Someone stole a bag from an employee of a business associate (BA), Premier Home Care Services, Inc., that contained a laptop computer and smartphone. The laptop and smartphone contained the electronic protected health information (ePHI) of 2,772 of the covered entity's (CE) members, including demographic, clinical and health claims information. The CE provided breach notification to HHS, the media, its health plan clients, and the affected individuals (including the offer of free credit monitoring at no cost to the affected individuals), and posted notice on its website. Following the breach, the CE contacted law enforcement, conducted a forensic investigation, and sanctioned its BA, including the suspension of the BA's services for six months until it demonstrated it had substantially remediated risk areas. In addition, the BA entered into a Security Assessment and Remediation Plan which required it to implement new and/or updated policies and procedures related to IT security. OCR obtained assurances that the BA implemented the corrective actions listed. Additionally, the BA is expected to conduct a risk analysis, implement a corresponding remediation plan, and ensure the implementation of policies and procedures relating to information system activity review, security incident response and reporting, access and audit controls, and creating/maintaining retrievable exact copies of ePHI.