Michael Benjamin, M.D., Inc.

The covered entity (CE), Michael Benjamin, M.D., Inc., reported that the office and file cabinets were broken into and patient charts containing protected health information (PHI) were taken. The types of PHI involved in the breach included demographic information, recorded vital signs, insurance eligibility information, and some copies of insurance cards and driver’s licenses or identification. Although 1,300 patient charts were in the cabinet, only 100 were actually taken, and 30 of the 100 were recovered from law enforcement. The CE provided breach notification to affected individuals, HHS, and the media. Following the break-in, the CE implemented more robust HIPAA policies and procedures. The CE improved safeguards by reinforced the physical security of its office. OCR obtained assurances that the CE implemented the corrective actions noted above.