Rotech Healthcare Inc.

A former employee of the covered entity (CE), Rotech, removed and retained electronic files from a company computer, some of which contained the protected health information (PHI) of employees in relation to the CE’s group health plan. The demographic, clinical and financial information of 10,680 individuals was affected by the breach. The CE provided breach notification to HHS, affected individuals, and the media. In response to the breach, the CE updated its policies and procedures regarding downloading of information from company-issued computers to external devices, retrieval of company-issued removable media from departing employees, and destruction of PHI and ePHI. The CE improved safeguards by disabling USB ports on most computers and encrypting all company laptops. Additionally, the CE conducted a HIPAA gap analysis, implemented a process for periodic analysis, and updated and secured the methods used to back up data. Finally, the CE obtained outside experts to assist in reviewing and enhancing HIPAA training and retrained employees. OCR obtained assurances that the corrective actions listed above were completed.