All Florida Orthopaedics

Law enforcement notified the covered entity (CE), All Florida Orthopaedic Associates, P.A., of a theft that occurred at its facility: an employee had stolen three blank checks from a patient; stolen a check from the CE’s shred bin; and possessed protected health information (PHI) for 12 additional patients. The breach involved demographic and financial information and affected 1,700 individuals, including patients whose records were accessed by the employee, and those that wrote checks during the employee’s tenure. The CE provided breach notification to HHS, affected individuals, and the media. In response to the breach, CE sanctioned the employee, retrained staff, removed all Social Security numbers from its electronic medical record system, and implemented new policies and procedures. OCR obtained assurances that the CE implemented the corrective actions listed above. In in this case the employee sanction included termination of employment.