Cancer Care Group, P.C.

Cancer Care Group, P.C. (Indiana radiation oncology practice) reported to HHS OCR on 2012-08-28 a Theft affecting ~55,000 current and former patients. A laptop bag containing an employee's computer and unencrypted backup media was stolen from the employee's car in July 2012. Exposed data included names, addresses, dates of birth, Social Security numbers, insurance information, and clinical information. OCR found no enterprise-wide risk analysis had been performed and no device/media control policy existed. Cancer Care settled with HHS for $750,000 and adopted a Corrective Action Plan. Breached information located on Other Portable Electronic Device.

Affected (this filing): 55,000