Lewis J. Sims, DPM, PC dba Sims and Associates Podiatry

Three laptop computers belonging to the covered entity (CE), Sims & Podiatry Associates’, were stolen from its office. The laptops were unencrypted and contained electronic protected health information (ePHI) that included 6,474 patients’ addresses, zip codes, dates of birth and vascular test results. The CE provided breach notification to HHS, affected individuals, and the media. As a result of OCR’s investigation, the CE installed new locks on all its doors and an alarm security system with central station monitoring. The CE also purchased replacement laptops and a new server. Additionally, the CE secured all laptops with cable locks and implemented full disk encryption along with antivirus and anti-malware software. Further, the CE implemented real-time offsite backup of all its ePHI. OCR specified its expectation that the CE conduct an on-going risk analysis, implement an on-going risk management plan, conduct periodic vulnerability scans and penetration tests, implement audit controls and perform information system activity review. Further, OCR expects the CE to upgrade encryption for the Poughkeepsie office and ensure that portable hard drives are stored in a secured location. The CE is also expected to provide on-going security awareness training to all staff.