Associated Dermatology & Skin Cancer Clinic of Helena

On May 29, 2018, the covered entity (CE) discovered that an employee’s patient care journal was stolen from her car on May 26, 2018. According to the CE, unbeknownst to it and contrary to its written policies and procedures, its employee maintained a personal care log as a tool to help her track patients’ treatment and prepare for visits. The breach reportedly affected 1,254 individuals, and their unsecured protected health information (PHI) included demographic and clinical information. The CE notified affected individuals, the media, and HHS. OCR verified that the CE had proper HIPAA policies and procedures in place to restrict impermissible uses and disclosures of PHI and require employees to safeguard all PHI. The CE also issued a written warning to the responsible employee and required her to complete a HIPAA refresher course.