Fresenius Medical Care (FMC) North America agreed to pay $3.5 million to settle potential HIPAA violations stemming from five breaches at different facilities caused by stolen or missing computers or USB drives, the HHS Office for Civil Rights said Feb. 1. Some of the computers were not encrypted, and one stolen laptop was in a workforce member’s bag with a list of her passwords.

Fresenius, a network of dialysis facilities, outpatient cardiac and vascular labs, and urgent care centers, submitted five breach reports to OCR on Jan. 21, 2013, on a “separate and distinct incident involving loss or theft,” OCR says. Here are the incidents, which occurred in 2012:

◆ Bio-Medical Applications of Florida, Inc., d/b/a FMC Duval: Two desktop computers were stolen during a break-in. One computer had 200 peoples’ protected health information (PHI), including patient names, admission dates, dates of first dialysis, days and times of treatments, dates of birth, and Social Security numbers.

◆ Bio-Medical Applications of Alabama, Inc., d/b/a FMC Magnolia Grove: An unencrypted USB drive was stolen from a workforce member’s car while it was parked in the lot there. On the USB drive was the electronic protected health information (ePHI) of 245 people, including patient names, addresses, dates of birth, telephone numbers, insurance companies, insurance account numbers and the covered entity location where each patient was seen.