Dermatology Associates of Tallahassee

The Secret Service discovered patient information pages printed from the covered entity's (CE) electronic medical record system at a vacant home in South Georgia. The breach affected 915 individuals whose names, dates of birth, insurance information, scheduling information, referring physicians, phone numbers and Social Security numbers were included on the printed pages. The CE delayed sending notification based on a law enforcement request. Once authorized to move forward, the CE timely sent breach notification to HHS, affected individuals, and the media. The CE also posted notification about the breach on its website. In response to the breach, the CE implemented changes to its policies and procedures and increased its monitoring of user activity on its computer system. OCR obtained assurances that the CE implemented the corrective actions listed above.