Henry Ford Health System

Henry Ford Health System, the covered entity (CE), reported a breach that occurred on October 23, 2014, when a physician lost a portable electronic device (a “flash” drive). The physician failed to adhere to the CE’s policy mandating use of employer-issued flash drives and padlocks. The breach affected 2,336 individuals. The protected health information (PHI) involved in the breach included clinical and demographic information. Following the breach, the CE provided breach notification to affected individuals, the media, and HHS. It also sanctioned the employee involved in the breach based on the severity of the noncompliance. OCR obtained documented assurances that the CE implemented the corrective action steps above. After OCR provided substantial technical assistance to the CE on the Security Rule’s Risk Analysis requirements, the CE provided written assurances to OCR that it will: create a more robust asset management program over the next 6-8 months and would provide that documentation to OCR; complete an enterprise data mapping and asset inventory by December 31, 2017; and 3) submit a fully executed copy of the business associate agreement (BAA) to OCR upon signature of a Master Service Agreement (MSA) and Statement of Work (SOW) for data mapping services once its vendor is chosen. This review was consolidated into an existing investigation of the CE.