Health Fitness Corporation

An unencrypted company laptop was stolen from the car of the business associate’s (BA) employee. The laptop contained the protected health information (PHI) of 3,804 individuals and included employees and/or spouses names, birthdates, health plan election, and social security numbers. The covered entity (CE) provided breach notification to HHS and the BA provided breach notification to affected individuals and the media. In response to this incident, the CE implemented a policy requiring encryption on all laptops containing PHI. The CE trained employees and provided refresher training regarding mobile device encryption. The BA implemented a new certification process to ensure client owned mobile devices are encrypted. OCR obtained assurances that the corrective actions listed above were taken.