Washington Health System Greene

Washington Health System Greene, the covered entity (CE), reported that an external computer hard drive for a bone densitometry machine was missing. The breach included the protected health information (PHI) of 4,145 individuals and included demographic and clinical information. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE improved physical safeguards and stopped using bone densitometry machines with external hard drives. The CE performed a new security risk analysis that focused on risks to mobile devices containing PHI. During the investigation, OCR reviewed the CE’s policies to ensure compliance with the Privacy and Security Rules.