What happened? * March 23, 2013 Oregon Health & Science University notified HHS of a breach due to a stolen unencrypted laptop. * May 1, 2013 OCR notifies them they are investigating the incident * July 28, 2013 Oregon Health & Science University notified HHS of another breach resulting from storing ePHI at an internet-based service provider without a business associate agreement * November 8, 2013 OCR notifies them they are investigating the new incident * July 18, 2016 settlement announced for $2.7 million and a 3 year CAP

What can we learn from this?  Go to Help Me WithHIPAA.com/65