On February 27, 2013, Valley Mental Health (Salt Lake area, UT) discovered that a desktop computer hard drive had been stolen from a common-area facility accessible to members. The drive contained PHI for approximately 700 individuals, including names, diagnostic and treatment information, financial records, media release forms, photographs, activity sign-up sheets, and resumes. The CE notified HHS, affected individuals, and media. OCR investigated and the CE implemented corrective actions: encrypting hard drives, securing PHI in locked offices, and posting member privacy reminders. OCR provided technical assistance on Security Rule obligations.
Affected (this filing): 700