University of Kentucky

A laptop computer containing the protected health information (PHI) of approximately 2,027 individuals was stolen from the covered entity (CE), University of Kentucky, Department of Pediatrics. The information was part of the New Born Screening Program sent to that department by the state screening program. The types of PHI involved in the breach included demographic information, specifically, names, addresses, dates of birth, social security numbers, and other identifiers, and clinical information. As a result of OCR’s investigation the CE provided OCR with an updated status report of its encryption project that it had previously reported as one of its corrective measures. It also trained workforce members on encryption of computing devices and provided reminders to workforce members about its facility locking procedures. Additionally, the CE provided a report of its information security assessment with details of security gaps as evidence of its risk analysis, along with recommendations for remediation of the gaps identified in the assessment. The CE also improved physical safeguards. The CE provided documentation of compliance with the applicable notification provisions of the Breach Notification Rule. It also updated its accounting of disclosures policy, and drafted a new policy relating to accounting of disclosures regarding breach incidents.