Department of Personnel and Administration

The Colorado Department of Personnel and Administration (a Business Associate) reported to HHS on 2011-06-29 a Theft/loss event affecting 3,589 individuals. The BA mailed a CD containing ePHI via inter-office mail to another city; the CD was lost en route. PHI included state Medicaid and children's health plan data. Breached information located on Other portable media (CD). The CE completed a risk analysis, notified affected individuals, HHS, and media, and required encryption of all future ePHI shipments. OCR obtained assurances of corrective action.