Massachusetts Eye and Ear Infirmary

Two employees of the covered entity (CE) misused credit card information from several different departments that served approximately 1,076 individuals. The protected health information (PHI) involved in the breach included names, addresses, and credit card information. Following the breach, the CE notified the affected individuals, the media, and HHS and offered one free year of credit monitoring to all affected individuals. The CE also terminated the employees involved, revised its data breach prevention policy, and reviewed the physical processes involved when payment is made in person using a credit card. OCR reviewed the CE's breach notification policies to assure that they contained the required elements and obtained assurances that the CE provided breach notification. \ \ \