Easter Seal Society of Superior California, Privacy Manager Breach

A work-issued laptop computer containing 3,026 clients’ protected health information (ePHI) was stolen out of an employee’s locked car. The types of ePHI involved in the breach included financial, demographic, and clinical information. The covered entity’s (CE) investigation revealed that, although the computer was powered off, password protected and not connected to the internet at the time of the theft, e-mails containing the respective e-PHI could still be accessed. The CE provided breach notification to HHS, affected individuals, and the media, and posted substitute notice on its website. It also provided affected individuals with one free year of credit monitoring and restoration, tips on protecting against ID theft, and a confidential privacy line to call with questions or concerns. Upon learning of the theft, the CE launched an internal investigation, hired specialized data security counsel to assist in responding to the incident, and retained external forensic experts to assist in determining the scope of the breach. The CE improved safeguards by reviewing its privacy and security policies and procedures, implementing a risk mitigation plan that reflects the current work environment, encrypting its laptop computers, and updating its policies and procedures on portable/mobile devices. It also retrained workforce members. OCR provided technical assistance regarding the HIPAA Security Rule requirements and obtained written documentation that the CE implemented the corrective actions listed above.