BioReference Laboratories, Inc

The covered entity (CE), BioReference Laboratories, Inc., reported that several employees took pictures of documents containing the protected health information (PHI) of 3,563 individuals. The PHI involved included names, dates of birth, addresses, health insurance information, Social Security numbers, diagnoses, lab results, and other treatment information. As a result of OCR’s investigation, the CE implemented additional administrative and technical safeguards to better protect its data, including creating a new policy outlining the acceptable uses of personal and handheld devices, and providing employees with encrypted communications tools. The CE provided complimentary credit monitoring and identity theft protection services to affected individuals. OCR obtained assurances that the CE implemented the corrective actions noted.