Aspire Indiana, Inc.

Aspire Indiana, Inc. (AII), the covered entity, reported that a break in at its administrative offices resulted in the theft of several laptops which were designated for office use only. The laptops contained protected health information (PHI) of approximately 43890 individuals. The PHI included clients’ names, addresses, SSN, and medical record numbers. The covered entity mitigated the breach by adopting encryption technologies, changed and strengthened its passwords requirements, trained and retrained its workforce, implemented its periodic technical and nontechnical evaluations, improved physical security, provided those affected with free credit monitoring, and sent out media notifications in which it notified those affected by the breach. During the investigation, OCR obtained documentation that the covered entity implemented the corrective actions listed above.