Henry Ford Hospital

Henry Ford Health System, the covered entity (CE), reported that a breach occurred on September 24, 2010, that affected 3,700 individuals and occurred when a laptop computer was stolen from an office left unlocked by an employee for approximately four hours while the employee was attending a meeting. The PHI involved in the breach included clinical and demographic information. The CE provided breach notification to the affected individuals, the media, and HHS. To resolve the issues raised by the breach, the CE sanctioned the employee involved in the breach based on the severity of the employee’s noncompliance, implemented an encryption process to purchase 2,000 additional encryption licenses, and implemented a program for receiving and using encrypted flash drives on March 14, 2011. OCR obtained documented assurances that the CE implemented these corrective action steps. After OCR provided substantial technical assistance to the CE on the Security Rule’s Risk Analysis requirements, the CE provided written assurances to OCR that it will: create a more robust asset management program over the next 6-8 months and provide documentation to OCR; complete an enterprise data mapping and asset; and submit a fully executed copy of the business associate agreement (BAA) to OCR upon signature of a Master Service Agreement (MSA) and Statement of Work (SOW) for data mapping services once its vendor is chosen. This case was consolidated into an existing investigation of the CE.