Losing a single laptop containing sensitive personal information about 441 patients will cost a non-profit Idaho hospice center $50,000, marking the first such penalty involving fewer than 500 data-breach victims.
The Department of Health and Human Services (HHS) announced last week that it has reached an agreement with the Hospice of North Idaho that will see the hospice pay $50,000 for violating the Health Insurance Portability and Accountability Act (HIPAA).
According to an article in The Spokesman-Review, the laptop was stolen from a hospice worker's car, and although the thief was apparently apprehended, the computer was not recovered. Amanda Miller, a spokeswoman for the hospice, told the newspaper that there was no evidence that any patient information had been abused.
"As a nonprofit, $50,000 is a lot of money and we are being extra resourceful right now to account for this settlement cost," (Miller) said.
The full agreement between the government and the hospice center can be read here.