Henry Ford Hospital

The Henry Ford Health System, the covered entity (CE) reported a breach that occurred on January 31, 2011 affecting 2,777 individuals. The breach occurred when an employee lost a personal portable electronic device (a “flash” drive) containing protected health information (PHI). The PHI involved in the breach included clinical and demographic information. The CE provided breach notification to the affected individuals, the media, and HHS. To resolve the issues raised by the breach, the CE sanctioned the employee involved in the breach based on the severity of the employee’s noncompliance, implemented an encryption process to purchase 2,000 additional encryption licenses, and implemented a program for receiving and using encrypted flash drives on March 14, 2011. OCR obtained documented assurances that the CE implemented these corrective action steps. OCR provided substantial technical assistance to the CE on the Security Rule’s Risk Analysis requirements. The CE provided the following written assurances to OCR that the CE will: create a more robust asset management program over the next 6-8 months and provide documentation to OCR; complete an enterprise data mapping and asset; and submit a fully executed copy of the business associate agreement (BAA) to OCR upon signature of a Master Service Agreement (MSA) and Statement of Work (SOW) for data mapping services once its vendor is chosen. This case was consolidated into an existing investigation of the CE.