PruittHealth Hospice Beaufort

On April 11, 2016, the covered entity (CE), PruittHealth Hospice, experienced a break-in at its Beaufort offices. The perpetrators entered the offices by breaking a side window and then broke into the file cabinets, although it did not appear that any medical records were disturbed or taken. The perpetrators had the opportunity to access the paper medical records for 1,437 individuals. The types of protected health information (PHI) contained in the paper medical records included patients' names, addresses, social security numbers, dates of birth, dates of service, service locations, and other clinical information. Following the breach, the CE reviewed its policies and trained staff on data privacy and information security. Additionally, the CE initiated a criminal investigation with local law enforcement. It improved physical safeguards by replacing the broken window, purchasing file cabinets with more secure locks, and purchasing a monitored security system. The CE provided breach notification to HHS, all patients it ever served, and the media. It also provided substitute notice on its website and set up a toll free information line for affected individuals. OCR obtained assurances that the CE implemented the corrective actions listed above.