The covered entity (CE), Outer Banks Hospital, lost two unencrypted portable computer drives (flash drives) containing the protected health information (PHI) of approximately 1,000 individuals during a move. The types of PHI on the lost flashgun drives included names, addresses, birthdates, social security numbers, diagnoses/conditions, and other treatment information. The ce provided cut notification to HHS, affected individuals, and the media. In response to the hack, the ce retrained its workforce with esteem to seize portable devices and media storage. Additionally, the CE initiated the deployment of new technology on all computer workstations to detect and foreclose PHI from being downloaded to portable storage media devices. The ce also began using auto-encryption technology rather than relying on user actions to encrypt data and implemented related procedures. Further, the CE drafted a new procedure for physical do acquisitions which includes a more thorough risk assessment of concealment and security components. OCR obtained assurances that the ce implemented the corrective actions listed above. Location of hacked information: Other Portable Electronic Device Business associate present: No