Reid Hospital & Health Care Services

An unencrypted, password protected laptop computer was stolen from an employee’s home on April 2, 2011. The covered entity (CE), Reid Hospital & Health Care Services, reported that this breach affected 22,001 individuals and that the laptop contained names, social security numbers, Medicare numbers, and some reports entitled “psychiatric services.” The CE investigated the breach and provided breach notification to HHS, affected individuals, and the media. As a result of OCR’s investigation, the CE completed encryption of its laptop and desktop computers, implemented safeguards for its email system and smartphones, and updated its mobile media policy. It also completed a new risk analysis and implemented action steps in its risk management plan. OCR obtained assurances that the CE implemented the corrective actions listed above.