Care Advantage, Inc.

The covered entity (CE), Care Advantage, Inc., experienced a break-in at a satellite office and the theft of 4 laptops. The laptops, which were password protected, contained the electronic protected health information (ePHI) relating to information used in a web based scheduling program. The breach report indicated that 3458 individuals were affected. Upon discovering the breach, the CE’s investigation revealed that the actual number of affected individuals was 420. The CE provided breach notification to HHS, and affected individuals and also posted notice of the incident on its website. Following the breach, the CE assessed and updated its HIPAA security policy, and conducted employee training. As a result of OCR’s investigation, OCR obtained written assurance that the CE has implemented the corrective action steps listed above.