CVS Health

On January 11, 2017, a box containing hard copy controlled substance prescriptions written between January 2, 2017 and January 11, 2017, was stolen by an unknown individual from a CVS, the covered entity (CE), in Michigan City, Indiana. The breach affected 724 individuals and the types of protected health information (PHI) involved included patients’ names, dates of birth, addresses, medication names, medication dosages, prescription numbers, and prescriber information. The CE provided breach notification to affected individuals, the media, and HHS. Following the breach, the CE retrained its staff at the Michigan City location. Additionally, the CE’s management conducted an internal audit to ensure that patient records were not easily visible to waiting customers or accessible by anyone standing outside of the pharmacy. OCR reviewed the CE’s policies and procedures on uses and disclosure of PHI and safeguarding PHI and obtained assurances that the CE implemented the corrective actions noted above.