Medtronic, Inc.

The covered entity (CE), Medtronic, misplaced a box of paper records containing the protected health information (PHI) of approximately 2,764 individuals. The box contained patient pump training records, including a checklist of training received, patients' names, device serial numbers, phone numbers, and, in some cases, email addresses. Some of the records may also have included social security numbers, medical necessity forms, physician orders, and copies of documents from one patient's medical record. The CE provided breach notification to affected individuals and HHS. Following the breach, the CE improved safeguards by redesigning its records tracking procedures and installing software with additional box tracking capabilities. OCR obtained assurances that the CE implemented the corrective action listed above. \ \ \