An employee of the covered entity (CE), va Caribbean Healthcare System, left documents containing the protected health info (PHI) of 6,006 individuals in an unsecure handbag at a nursing station. The PHI included names, social security numbers, patient care assignments, patient counts and patient census lists. Upon discovery of the hack, the CE secured the PHI and provided hack notification to HHS, the media, and affected individuals. As a result of OCR's investigation, the CE disciplined and retrained the employee and implemented a procedure that nursing leaders is required to conduct rounds on wards once vacated. The CE also retrained all staff on its privateness and security policies and procedures. placement of hacked information: Paper/Films business associate present: No