Centers Plan for Healthy Living

About this report

An unencrypted laptop computer containing the electronic protected health information (ePHI) of 6,893 beneficiaries was stolen from the covered entity’s (CE) corporate offices. The ePHI included names, addresses, dates of births, Medicare and/or Medicaid numbers. The CE provided breach notification to HHS, the affected individuals and the media. Following the breach, the CE encrypted all laptops, revised its encryption policy and procedure, retrained staff on HIPAA, terminated its contract with the cleaning service and entered into a new agreement with another cleaning service that ensured background checks of all staff. OCR obtained assurances that the CE implemented the corrective actions listed. The CE is expected to conduct a risk analysis and implement a corresponding remediation plan.

Summary as published by the HHS Office for Civil Rights.