NDHHS OCRFirst filing
Filed Nov 17, 2011bd_1f1715c08a210185
On or about October 21, 2011, MedCenter One, Inc. (ND) failed to safeguard the ePHI of approximately 650 patients when an unencrypted, password-protected laptop and a bag containing 11 patient charge tickets were stolen from an employee's vehicle. ePHI involved included demographic information. The CE notified HHS, affected individuals, and the media. Corrective actions included encrypting all laptops, new IT security policies, staff retraining, and employee sanction. OCR obtained assurances of implementation. MedCenter One later merged with Sanford Health on July 3, 2012. Breached information located on Laptop.
Affected (this filing): 650
HHS notified