Stanford Hospital & Clinics and School of Medicine, Privacy Manager Breach

The covered entity (CE), Stanford Health Care (SHC)(formerly Stanford Hospital and Clinics), and Stanford School of Medicine (SOM), reported that on July 15 or 16, 2012, a password-protected computer was stolen from a locked SOM workforce member's office. The electronic protected health information (ePHI) of approximately 2,641 individuals may have been affected by this incident. The ePHI involved in the breach included clinical and demographic information related to SHC patient care and SOM research. The CE reported that there was no evidence to indicate that ePHI had been inappropriately accessed. The CE contacted law enforcement, notified the affected individuals, offered identity protection services at no cost to the affected individuals, established a toll-free call center to assist affected individuals with questions or concerns, and notification the media and HHS. As a result of the breach and OCR’s corresponding investigation, the CE implemented additional physical safeguards, audited SCH desktops and laptops to ensure encryption, issued security awareness reminders to workforce, and initiated plans to implement an improved risk management process.