Two encrypted laptops containing Protected Health Information $($PHI$)$ were stolen from a locked conference room at a client location. These laptops were assigned to IT employees working on a data migration project. FINDINGS:A law enforcement investigation determined a security guard responsible for securing the incident location had stolen the two laptops, one of which was recovered by the company. After a thorough investigation and analysis of the recovered computer, no evidence was found indicating unauthorized network intrusion or that PHI was accessed after the computer was stolen. Computer analysis determined that IT employees had stored PHI on an unencrypted partition on the local hard drive. The investigation team determined that over a million members data may have been breached.