Eisenhower Medical Center in Rancho Mirage, Calif., says the computer and a television were stolen from the hospital on March 11. The computer contained a patient index backup file that included patient names, ages, dates of birth, the last four digits of Social Security numbers and the hospital's medical records numbers. It did not contain health or financial information.
The hospital is cooperating with law enforcement officials on the investigation. "At this time, EMC has no reason to believe that the computer was stolen for the information that it contained," the hospital said in a press release.
In the wake of the incident, "EMC's safeguard requirements and policies and procedures for computers were reviewed, and patient index data was moved from individual computers to our secure data center," according to the release. "To the extent that the data may be needed outside of the secure data center, it will be encrypted and returned to the data center when it is no longer needed. We have also taken steps to further secure our facilities during of-hours."
The HITECH Act breach notification rule requires notifying patients of breaches. Incidents affecting 500 or more must be reported to the Department of Health and Human Services' Office for Civil Rights within 60 days. This incident, however, is not yet on the OCR's list of major health information breaches.