Hartford Hospital

A workforce member of the covered entity's (CE) business associate (BA) saved the electronic protected health information (ePHI) of approximately 93,500 patients on an unsecured computer drive in order to do work from home, and subsequently lost the hard drive. The PHI included names, addresses, dates of birth, marital status, social security numbers and medical record numbers. Following the breach, the workforce member involved was sanctioned for violating the CE's policies. The CE provided breach notification to the media, HHS, and all affected individuals. It also offered all affected individuals 2 years of free identity protection services. In addition, the CE disabled the ability for all of its computing devices to download ePHI via USB connection ports. Further, it began implementing malicious software prevention utilities as well as data encryption controls to supplement its portable computing devices. OCR obtained assurances that the CE implemented the corrective action listed above. The breach incident involved a BA and occurred prior to the September 23, 2013, compliance date. OCR verified that the CE had a proper BA agreement in place that restricted the BA's use and disclosure of PHI and required the BA to safeguard all PHI. \ \ \ \