The Brookdale Hospital and Medical Center

The covered entity (CE), Brookdale Hospital and Medical Center, reported a breach when a staff pharmacist lost an unencrypted USB external hard drive that contained the electronic protected health information (ePHI) of 2,700 patients. The ePHI included addresses, zip codes, dates of birth, diagnosis codes, and medical record numbers. The CE provided breach notification to HHS, the affected individuals, and the media. Following the loss, the CE disabled all USB ports in all of its computers to prevent any staff members from using USB external hard drives to store data from its electronic records system, established a policy on obtaining an encrypted USB external hard drive from its IT department, and retrained its pharmacist staff. As a result of OCR’s investigation and technical assistance, the CE is expected to review and revise its policies and procedures and training materials regarding reporting breach incidents and the usage of mobile and portable devices by its staff members. Additionally, OCR stated the expectation that the CE will perform a thorough and accurate enterprise wide risk analysis and establish a Risk Management Plan that addresses the threats and vulnerabilities identified by the risk analysis.