Capron Rescue Squad District

A trustee of the covered entity (CE), Capron Rescue Squad District, removed a laptop computer containing the unencrypted electronic protected health information (ePHI) of 815 individuals from its facility under the mistaken belief that the laptop was no longer used by the CE in its provision of health care services and gave the laptop to his adult grandson. The ePHI on the laptop included individuals’ full names, social security numbers, dates of birth, home addresses, and medical histories. The CE recovered the laptop which was the subject of the breach and obtained written assurances from the individuals involved in the breach that they did not use, disclose, or retain any ePHI stored on the laptop. The CE provided breach notification to HHS, the media, and affected individuals. The CE improved safeguards by encrypting ePHI stored on its computers, including laptops. OCR obtained assurances that the corrective actions listed above were completed.