Barnabas Health Medical Group, P.C.

An unencrypted laptop computer that was used to conduct spirometry tests was stolen from an office of the covered entity (CE), Barnabas Health Medical Group, P.C., during office hours, affecting 1,099 individuals. The types of protected health information (PHI) involved in the breach included demographic and clinical information. The CE provided breach notification to HHS, the media, and the affected individuals. Following the breach, the CE reported the theft to law enforcement, conducted an internal investigation, and conducted on-site reviews of every CE office to confirm there were no other unencrypted devices. Following the breach, the CE also retrained staff on privacy and security issues, and obtained a new spirometer with improved safeguards. OCR obtained assurances that the CE implemented the corrective actions listed. Additionally, as a result of OCR’s investigation, the CE is expected to conduct a risk analysis, implement a corresponding remediation plan, implement policies and procedures relating to biomedical devices containing electronic PHI, and regularly review records of information system activity.