The Nemours Foundation

A locked cabinet was removed from an IT service desk area at the Wilmington, Delaware facility of the covered entity (CE), The Nemours Foundation during an August 2011 remodeling project. The cabinet housed three unencrypted backup tapes containing the electronic protected health information (ePHI) of 1,055,489 individuals. The ePHI involved in the breach included patients’ names, addresses, social security numbers, diagnoses and procedure codes. The CE provided breach notification to HHS, affected individuals, and the media, and offered one year of free credit monitoring to affected individuals. Following the incident, the CE hired a private investigator to assist in locating the missing backup tapes; however, they were not recovered. Additionally, the CE retained Navigant Consulting to assess the recoverability of the information and to conduct a validation review of CE’s internal analyses. In response to the incident, the CE improved safeguards by encrypting all backup tapes, storage devices, and electronic media that may contain e-PHI, moving backup tapes to a secure off-site facility, installing non-movable storage cabinets in its data centers, and implementing two-factor authentication for access to ePHI. It also hired a system administrator to manage and audit backup procedures, retrained staff, and updated and created HIPAA policies and procedures, including role-based access to cabinets containing backup data. OCR obtained assurances that the corrective actions listed above were carried out.