FOOTHILLS NEPHROLOGY, PC

A company-issued laptop computer containing the protected health information (PHI) of approximately 1,280 individuals was stolen from the vehicle of a covered entity's (CE) employee. The PHI included demographic and clinical information. The CE provided breach notification to the affected individuals, HHS, and the media and created a toll-free number for information regarding the incident. As a result of this incident, the CE contacted law enforcement, retrained staff on the use of portable media, and initiated a risk analysis. Following the OCR investigation, the CE reviewed and updated its policies and procedures to ensure adequate safeguards, instituted a new electronic medical records system which encrypts medical information, updated password requirements for computers, and retrained employees.