Data Breach Enforcement Companies that provide mobile health (mHealth) solutions ( i.e., mobile applications, wearables, remote monitoring devices and other mobile technologies that facilitate health care) should note that CardioNet, a provider of remote mobile monitoring, reached a $2.5 million data breach settlement with the Office for Civil Rights (OCR) of the US Department of Health and Human Services (HHS). The settlement related to two breaches of electronic protected health information (ePHI), one involving the theft of a workforce member's laptop containing ePHI from a parked vehicle, and another as to which OCR did not provide any details. OCR alleged several failures by the company to implement appropriate security safeguards required under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), including having policies and procedures addressing the receipt, removal and encryption of hardware and electronic media, and conducting an accurate and thorough security risk assessment.