Boston Health Care for the Homeless Program

The covered entity (CE), Boston Health Care for the Homeless Program, inadvertently left the clinic door unlocked after hours and staff discovered a guest of the adjacent shelter sleeping in an exam room the following morning. There was no evidence that the guest accessed protected health information (PHI); however, the PHI of approximately 861 individuals was stored in the clinic, including demographic and clinical information. As a result of OCR’s investigation, the CE updated a relevant administrative safeguards policy and retrained staff on the revisions, implemented additional physical and technical safeguards, and notified potentially affected individuals pursuant to the Breach Notification Rule. OCR provided technical assistance to the CE regarding the timeliness requirements for notification to OCR and individuals. OCR also reviewed the CE’s relevant policies and procedures and they appear to comply with the HIPAA Rules.