What happened?

• March 23, 2013 Oregon Health & Science University notified HHS of a breach due to a stolen unencrypted laptop.
• May 1, 2013 OCR notifies them they are investigating the incident
• July 28, 2013 Oregon Health & Science University notified HHS of another breach resulting from storing ePHI at an internet-based service provider without a business associate agreement
• November 8, 2013 OCR notifies them they are investigating the new incident
• July 18, 2016 settlement announced for $2.7 million and a 3 year CAP

What can we learn from this? Go to Help Me WithHIPAA.com/65