Independence Care System

An unencrypted laptop computer belonging to the covered entity (CE), Independence Care System, was stolen from an employee’s home. The laptop contained reports that included 2,500 members' names, addresses, telephone numbers, Medicaid identification numbers, internal identification numbers, enrollment dates, and disenrollment dates. The CE provided breach notification to HHS, affected individuals, and the media. As a result of OCR’s investigation, the CE encrypted all of it is laptop computers. The CE also updated its policies and procedures for encryption of desktop computers, laptops, and mobile devices, security, and security awareness training. Additionally, the CE performed an information security assessment of its modified IT environment and implemented the findings of the remediation plan. OCR indicated an expectation that the CE will review its updated security training to confirm whether it meets the standard of the Security Rule, conduct a risk analysis, implement a risk management plan, and implement policies and procedures for security incidents, physical security, and a facility security plan. In addition, OCR provided and expectation that the CE will provide on-going security awareness training to all staff.