Inspira Behavioral Care, Corp

Inspira Behavioral Care, Corp., the covered entity (CE), discovered that an unencrypted, password-protected computer containing protected health information (PHI) was stolen from its facility. The breach affected 4,246 individuals. The PHI involved included names, dates of birth, diagnoses, and treatment information. The covered entity provided breach notifications to HHS, all affected individuals, and the media. Following the breach, the covered entity reminded all workforce members to store all e-PHI on its secure cloud storage server. The covered entity sanctioned workforce members for failure to adhere to its policies and procedures regarding compliance with the HIPAA Security Rule. It encrypted all computers containing e-PHI, and installed physical security measures at its facility. In addition, it re-trained all staff members on the HIPAA Privacy and Security Rules. OCR obtained assurances that the covered entity implemented the corrective actions noted above.