The MS Center of Saint Louis and Mercy Clinic Neurology - Town and Country

On July 17, 2017, the covered entities (CE), MS Center of Saint Louis and Mercy Clinic Neurology – Town and Country, discovered that certain staff had completed patient medication onboarding forms on behalf of patients as part of the CEs’ medication procurement process and submitted them to pharmaceutical companies without patient authorization or consent. For those portions of the forms requiring the patient’s signature, including the optional authorization provisions permitting disclosure of protected health information (PHI) for marketing purposes, the staff signed the patient’s name on the form. Upon discovery of the above, the CEs immediately required staff to stop this practice. The information contained on the onboarding forms included the demographic and clinical information of approximately 1,081 individuals. The CE, MS Center, provided breach notification to HHS, affected individuals, and the media, and also posted substitute notice. Following the breach, the CE sanctioned the employee responsible for the breach and the supervising physician, adopted a new procedure for completing the medication onboarding forms; began monitoring compliance with the new procedure, retrained staff and required staff to sign confidentiality acknowledgments. OCR obtained documented assurances that the CEs implemented the above-listed voluntary corrective action steps. The CE, MS Center of Saint Louis, closed its operations as of March 30, 2018.