Skip to main content

HHS.gov
Search
U.S. Department of Health & Human Services

Close

A-Z Index

      - About HHS
      - Programs & Services
      - Grants & Contracts
      - Laws & Regulations

Home > About > News > Lifespan Pays $1,040,000 to OCR to Settle Unencrypted Stolen Laptop Breach

            - Text Resize                                   A  A  A 
            - Print  
            - Share                                       

View 2016 - 1991 archive

[email protected]

# Lifespan Pays $1,040,000 to OCR to Settle Unencrypted Stolen Laptop Breach

Lifespan Health System Affiliated Covered Entity (Lifespan ACE), a non-profit health system based in Rhode Island, has agreed to pay $1,040,000 to the Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services (HHS) and to implement a corrective action plan to settle potential violations of the Health Insurance Portability and Accountability Act (HIPAA) Privacy and Security Rules related to the theft of an unencrypted laptop.  Lifespan ACE includes many healthcare provider affiliates in Rhode Island, and has designated itself as a HIPAA affiliated covered entity.1

On April 21, 2017, Lifespan Corporation, the parent company and business associate of Lifespan ACE, filed a breach report with OCR concerning the theft of an affiliated hospital employee’s laptop containing electronic protected health information (ePHI) including: patients’ names, medical record numbers, demographic information, and medication information. The breach affected 20,431 individuals.

OCR’s investigation determined that there was systemic noncompliance with the HIPAA Rules including a failure to encrypt ePHI on laptops after Lifespan ACE determined it was reasonable and appropriate to do so.  OCR also uncovered a lack of device and media controls, and a failure to have a business associate agreement in place with the Lifespan Corporation.

“Laptops, cellphones, and other mobile devices are stolen every day, that’s the hard reality.  Covered entities can best protect their patients’ data by encrypting mobile devices to thwart identity thieves,” said Roger Severino, OCR Director. 

In addition to the monetary settlement, Lifespan has agreed to a corrective action plan that includes two years of monitoring. The resolution agreement and corrective action plan may be found at: https://www.hhs.gov/sites/default/files/lifespan-ra-cap-signed.pdf*.

* People using assistive technology may not be able to fully access information in this file. For assistance, contact the HHS Office for Civil Rights at (800) 368-1019, TDD toll-free: (800) 537-7697, or by emailing [email protected].
                        - 1.  Legally separate covered entities that are affiliated may designate themselves as a single covered entity for purposes of 45 CFR Part 164. See 45 CFR 164.105(b)(1).

https://www.hhs.gov/newsHHS on Facebook@HHSgovHHS Email Updates

## Sign Up for News Release Updates

Enter your email:

## Subscribe to RSS

Receive latest updates

## Related News Releases

OCR Settles Thirteenth Investigation in HIPAA Right of Access Initiative

OCR Issues Guidance on HIPAA, Health Information Exchanges, and Disclosures of Protected Health Information for Public Health Purposes

OCR Issues Audit Report on Health Care Industry Compliance with the HIPAA Rules

## Public Affairs Contacts

HHS Media InformationASPA Press ContactsHHS Agency Press Contacts

**View all**

## Connect With Us

## Sign Up for Email Updates

To sign up for updates or to access your subscriber preferences, please enter your contact information below.

## HHS Headquarters

U.S. Department of Health & Human Services						200 Independence Avenue, S.W.						Washington, D.C. 20201						Toll Free Call Center: 1-877-696-6775​

              - Contact HHS
              - Careers
              - HHS FAQs
              - Nondiscrimination Notice

              - HHS Archive
              - Accessibility
              - Privacy Policy
              - Viewers & Players

              - Budget/Performance
              - Guidance Portal
              - Inspector General
              - EEO/No Fear Act

              - FOIA
              - The White House
              - USA.gov

Back to *T*op