James M. McGee, D.M.D., P.C.

The covered entity’s (CE) locked storage unit was broken into and hard copies of 1,306 patients’ medical records were stolen. The types of protected health information (PHI) in records included patients’ full names, social security numbers, home addresses, telephone numbers, dental charts, insurance information, and payment information. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE repaired the door to the storage unit, added a professional lock, and destroyed outdated patient records. The CE retrained staff, deployed new practice management software for storage of electronic patient records, and transferred storage of paper records on-site. OCR obtained assurances that the CE implemented the corrective actions listed above.