Tomas, Arturo

On February 2, 2014, Artuo D. Tomas, MD LTD's office, the covered entity (CE), discovered that a package containing the protected health information (PHI) of approximately 680 individuals had been lost in the process of shipment to its billing company through the U.S. Postal Service (USPS). The PHI included individuals’ names, addresses, phone numbers, dates of birth, referring physician names, medical record numbers, diagnoses, and clinical information. The CE provided notification of the breach to the affected individuals, HHS, and the media. The CE also filed a claim with the USPS regarding the missing package. Following the breach, the CE implemented a new procedure for sending PHI to the billing company that requires PHI to be transmitted either electronically through a secure and encrypted portal or through a third-party mail service with tracking capabilities. Additionally, the CE developed policies and procedures regarding compliance with the Breach Notification Rule. OCR obtained assurances that the CE implemented the corrective actions listed.