HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Feb. 15, 2019.
- Organization as reported
- OneDigital/Digital Insurance, LLC, GA
- Entity type as reported
- Business Associate
- Category as reported
Theft
- Location of information as reported
- Laptop
- Submission date
- Feb. 15, 2019
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13527, row:4666)
- Archived copy
- Held in the private archive (provenance)
On January 7, 2019, a business Associate (BA), OneDigital/Digital Insurance, LLC, discovered that an employee’s unencrypted laptop computer was stolen. The laptop contained the protected health information (PHI) of 4,045 individuals in the employee’s email account on the computer hard drive, including demographic, financial, clinical, and health plan information. The BA activated contingency protocols on the stolen laptop to prevent remote access to the BA’s network. From February 15, 2019, to April 8, 2019, the BA notified its affected clients (136 covered entities) of the breach and assisted with breach notification obligations. In response to the breach, the BA reset passwords, revised security policies, and sanctioned and retrained employees. Before the theft, the BA was in the process of encrypting laptops and anticipates that all laptops will be encrypted by the end of 2019. OCR obtained assurances that the BA implemented the corrective actions listed above and performed notification obligations.