Burglars stole documents including patients’ protected health information (PHI) from a locked cabinet at Anne Arundel Dermatology, the covered entity (CE). The breach affected approximately 1,324 individuals and the types of PHI involved included names, addresses, bank account numbers, and clinical and diagnostic information. The CE provided reach notification to HHS, affected individuals, and the media. Following the breach, the CE implemented additional physical safeguards. OCR reviewed the CE's policies and procedures to ensure compliance with the Privacy and Security Rules.
