PMC Medicare Choice

Thieves broke into the PMC Medicare Choice facility located in Humacao, Puerto Rico and stole four unencrypted desktop computers containing 24,361 health plan members’ electronic protected health information (ePHI). The ePHI included names, addresses, phone numbers, Medicare HIC numbers, diagnosis and treatment information, health plan names, health plan member identification numbers, health plan enrollment information, health care claim information, and social security numbers. The covered entity (CE) provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE repaired a damaged wall and improved security at the facility and the surrounding premises. OCR obtained assurances that the CE implemented the corrective actions noted above. As a result of OCR’s investigation, the CE encrypted all computers located at its regional offices. OCR stated its expectation that the CE will perform a thorough and accurate risk analysis and establish a risk management plan. In addition, OCR stated an expectation that the CE will implement contingency operations procedures, implement its facility security plan’s policies and procedures, and regularly patch and update its IT infrastructure. OCR also stated an expectation that the CE will encrypt and decrypt ePHI where appropriate and document the technical safeguards implemented to prohibit the unauthorized copying and removal of PHI and ePHI.