Walmart Stores, Inc.

Walmart Stores, Inc. (Walmart), the covered entity (CE), discovered that a software change on its computer system caused a technical error that resulted in the electronic protected health information (ePHI) to be viewable on its online pharmacy account portal. This breach affected 4,800 individuals and the ePHI involved included names, addresses, phone numbers, email addresses, prescriptions, insurance information, treatment information and the last four digits of its patients' credit card numbers. Walmart notified all affected individuals and offered identity theft protection services. As a result of this incident, Walmart conducted an internal investigation and implemented additional privacy and security measures. It also created a cross-functional team of subject matter experts to be used when migrating to new technologies or when undertaking significant redesign efforts. OCR obtained assurances from Walmart that it implemented the actions noted above.