United HomeCare Services, Inc.

On January 8, 2013, an employee’s unencrypted laptop (owned by the covered entity (CE), United HomeCare Services, Inc.,) was stolen from her locked vehicle. The laptop contained demographic data, including names, dates of birth, addresses, and social security numbers, as well as clinical and health insurance information affecting 12,299 patients of the CE and 1,318 clients of its subsidiary, United Home Care Services of Southwest Florida, LLC. The CE provided breach notification to HHS, affected individuals, and the media and posted substitute notice on its website. In response to the breach, the CE encrypted its portable devices and provided specialized training to its workforce. OCR obtained assurances that the CE implemented the corrective actions listed above. The employee at fault was suspended without pay for 5 days and resigned shortly thereafter.