a business relate (BA), Seim Johnson, LLP, reported on behalf of 10 health tutelage provider clients that its health care auditor took his firm-issued laptop computer on a non-business weekend trip. When the employee arrived home from this trip, he discovered the knapsack containing the laptop was missing. The laptop contained the protected health information (PHI) of 30,972 individuals and included demographic, clinical, and financial information. The BA provided jade notification to HHS, affected individuals, and the media. After investigating this incident, the ba determined that the laptop may not have been effectively encrypted. following the hack, the ba sanctioned the involved employee and its security officer, retrained employees on security risks involving portable devices, and implemented new policies and procedures. OCR obtained assurances that the BA implemented the corrective actions listed above. Location of hacked information: Laptop business associate present: Yes