Henry Ford Health System

Henry Ford Health System, the covered entity (CE) reported breaches that occurred on September 24, 2010, January 31, 2011, August 5, 2011, and October 23, 2014. OCR consolidated the breaches into one investigation because the breaches contained similar issues and each breach involved employees who failed to follow the CE’s policies or procedures. The September 24, 2010, breach affected 3,700 individuals and occurred when a laptop computer was stolen from an office left unlocked by an employee for approximately four hours while the employee was attending a meeting. The January 31, 2011, breach affected 2,777 individuals and occurred when an employee lost a personal portable electronic device (a “flash” drive) containing protected health information (PHI). The August 5, 2011, breach affected 520 individuals and occurred when an unencrypted desktop computer was stolen from a lab with secure access for workforce members. The desktop computer had been purchased directly by the department instead of through the CE’s established computer purchase procedures. The October 23, 2014, breach affected 2,336 individuals and occurred when a physician lost a flash drive. The physician failed to adhere to the CE’s policy mandating use of the CE’s issued flash drives and padlock. The PHI involved in the breaches included clinical and demographic information. The CE provided breach notification to the affected individuals, the media, and HHS. To resolve the issues raised in these matters, the CE took the following voluntary actions: 1) sanctioned the employees involved in the breaches depending on the severity of the employees’ noncompliance; 3) following the September 24, 2010 breach, implemented an encryption process to purchase 2,000 additional encryption licenses; 4) and on March 14, 2011, implemented a program for receiving and using encrypted flash drives. OCR obtained documented assurances that the CE implemented the corrective actions noted above. After OCR provided substantial technical assistance to the CE on the Security Rule’s Risk Analysis requirements, the CE provided the following written assurances to OCR that it will: create a more robust asset management program over the next 6-8 months and would provide documentation of the program to OCR; complete an enterprise data mapping and asset inventory by December 31, 2017; and submit a fully executed copy of the business associate agreement (BAA) to OCR upon signature of a Master Service Agreement (MSA) and Statement of Work (SOW) for data mapping services once its vendor was chosen.