101 Family Medical Group, Privacy Manager Breach

101 Family Medical Group (CA) reported to HHS on 2014-01-08 a Theft affecting 2,500 individuals. A laptop owned by business associate Phreesia, Inc. was stolen from a parked car. In violation of BA policies, the laptop's hard drive and the workforce member's Dropbox account contained ePHI including names, addresses, ID numbers, phone numbers, email addresses, dates of birth, SSNs, and insurance IDs. The BA sanctioned the employee, retrained staff, and updated device/media control and sanctions policies following an OCR investigation.