GRM Information Management Services

Unencrypted clinical system backup tapes containing ePHI of 1,700,000 individuals were stolen from an unlocked vehicle belonging to an employee of GRM Information Management Services, a business associate of the covered entity. ePHI included names, MRNs, SSNs, addresses, phone numbers, health plan numbers, dates of birth/admission/treatment/discharge/death, mother's name, next of kin, and clinical information (diagnoses, treatment, prognosis, lab results, medications). The covered entity filed a police report, notified HHS, media, and affected individuals, terminated the BA agreement, and installed encryption software on backup media following OCR's investigation. Incident occurred prior to the September 23, 2013 HIPAA Omnibus compliance date.