Elite Imaging

A log book (sign-in book) containing information about the covered entity’s (CE) patients was stolen from its offices and returned anonymously with a letter. The log-book contained the patients’ full names and the name of the procedure conducted for each patient. The breach affected 1,457 patients. The CE provided breach notification to HHS, affected individuals, and the media. The CE conducted a full review of the incident and filed a police report. It also reviewed and modified its safeguards policies and internal procedures, implemented a new log in procedure, updated its software, and re-trained all staff received on its new policies. The CE’s shredding vendor securely disposed of the log books. OCR obtained assurances that the CE implemented the corrective actions listed above.