The resulting federal investigation indicated that Massachusetts Eye and Ear had ???failed to take necessary steps to comply with certain??? Security Rule requirements, including ensuring data maintained on portable devices, such as laptop computers, was protected from unauthorized users and that procedures were in place for identifying and reporting data security incidents, according to the HHS r