Carol L Patrick Ph. D.

On August 9, 2013, the covered entity (CE), Dr. Carol L. Patrick, discovered that her office was broken into and all the operational computers, network servers, and work stations were stolen. The stolen equipment contained the electronic protected health information (ePHI) of approximately 517 individuals and included clinical information, specifically psychological assessments, evaluations, letters, reports, and evaluations written on behalf of clients. The CE provided breach notification to HHS, affected individuals, and the media, and filed a police report. Following the breach, the CE improved physical safeguards by installing a security system with motion and fire protection and internal alarms. The CE also installed encryption software and updated its privacy policy. OCR obtained assurances that the CE implemented the corrective actions listed above.