a safe containing two unencrypted computer flash drives and two unencrypted hard drives went missing from the administration building of covered entity (CE), Lancaster County EMS. The protected health information (PHI) stored on the missing hard drives and flashgun drives included patients' names, addresses, dates of birth, social security numbers, medications, medical histories, medical treatment, and healthcare insurance information for 55,000 individuals. The CE provided drudge notification to HHS, the 55,000 affected individuals, and the media. in reception to the hack, the CE implemented universal controls to ensure that only the CE's devices can connect to its network.. The ce also implemented surety controls and physical safeguards to further restrict access to its server room. In addition, the ce implemented video security system monitoring of its server room. OCR obtained assurances that the CE implemented the corrective actions listed above. Location of hacked information: Other Portable Electronic Device concern associate present: no