The Corvallis Clinic, P.C.

A personal laptop computer belonging to an employee of the covered entity (CE), The Corvallis Clinic, P.C., was stolen from the employee’s locked automobile. The stolen laptop contained the electronic protected health information (ePHI) of 41,000 individuals and included patients’ names, addresses, dates of birth, phone numbers, appointment dates, and the names of treating providers. The CE provided the required notifications under the Breach Notification Rule. Following the breach the CE sanctioned the involved employee and implemented network access control software that restricts employees from gaining access to internal network resources using personally owned equipment. OCR’s investigation confirmed that the appropriate notifications were made and that corrective action steps were taken.