Roper St. Francis Healthcare

A camera with infant security photos went missing when a nurse failed to store the camera in its normal secure location at Roper St. Francis, Mount Pleasant Hospital. The breach affected the protected health information (PHI) of 508 newborn patients. The types of PHI on the camera included photographs of patients, patients’ last names, dates of birth, and providers’ names. In response to the breach, on December 4, 2016, the covered entity (CE) ended the procedure of taking security photos of newborns and staff members were advised to continue to ensure the safety of infants by identifying them with appropriate matching bracelets, utilization of the infant security tags and system, and education to the family. On January 24, 2017, the CE implemented an Information Services Security Incident Response Procedure to facilitate timely and effective handling of all cybersecurity computer incidents and trained staff in the affected unit on its HIPAA policies and procedures. The CE provided breach notification to HHS, the parents of affected newborns and the media. The CE offered credit monitoring and identity protection services to affected individuals and established a call center related to the breach. OCR obtained assurances that the CE implemented the corrective actions listed above.