The Guidance Center of Westchester

\NOn February 22, 2013, a CPU that contained the protected health information (PHI) of 1,416 individuals was stolen from the covered entity (CE), Guidance Center of Westchester. The types of PHI involved in the breach included the individuals’ names, dates of birth, dates of admittance, insurance carriers’ names, home addresses, diagnoses, outpatient treatment authorization requests, social security numbers, treating physicians’ names, case numbers and other identifiable information. Upon discovering the breach, the CE filed a police report and notified the New York State Attorney General’s Office, New York State Office of Cyber Security, New York State Department of State Division of Consumer Protection and the Connecticut Attorney General’s Office. The CE provided breach notification to HHS, affected individuals, and the media and offered one year of free credit monitoring services to affected individuals. As a result of the breach, the CE encrypted all of its desktop and laptop computers and disabled the use of portable devices with a Universal Serial Bus (USB) connection. The CE initiated plans to relocate two of its offices to buildings with security cameras and to install security cameras at another location. OCR obtained assurances that the CE implemented the corrective actions listed above.