Cancer Specialists of Tidewater

The covered entity (CE), Cancer Specialists of Tidewater, was notified by the Chesapeake Virginia Police Department that an employee was arrested and charged with taking credit card information from patients’ belongings during office visits. The breach report indicated that over 500 individuals were affected and the types of protected health information (PHI) involved in the breach included demographic and financial information. Following the CE’s investigation and electronic audit, it provided breach notification to a total of 2,318 patients, HHS, and the media, and posted substitute notice on its website. Following the breach, the CE conducted a risk assessment, upgraded breach detection software, and increased its auditing capabilities. It also conducted employee training. OCR obtained written assurance that the CE implemented the corrective actions listed above. Additionally, the CE terminated the employment of the involved employee.