On June 22, 2017, a digital camera containing photographs of patients' chart labels and skin conditions was stolen from a physician's vehicle parked outside the physician's home. The camera held PHI created between February 15 and June 21, 2017, affecting 902 individuals' demographic and clinical information. Spectrum Health System (MI) submitted breach notification to HHS on August 3, 2017. Breached information was located on another portable electronic device. The CE notified affected individuals and media, posted substitute notice, and established a call center. Corrective actions included mobile device encryption policies, camera removal ban, and a 2018–2019 enterprise-wide risk analysis. OCR obtained documented assurances of compliance.
Affected (this filing): 902