Centerstone

A major flooding event damaged a building where the CE operated its school-based program offices. The flooding was so significant that the area was deemed a federal disaster area. An estimated 1,537 individuals were affected by the loss of data due to flood damage. The types of PHI involved were names, addresses, dates of birth, and social security numbers. After the flood, the CE attempted to collect as much PHI as it could from the site but access was limited by authorities because the building was deemed toxic and salvage cleanup commenced prior to the CE's ability to access the building. PHI in paper format was either washed away or disposed of during salvage procedures. Computers and equipment in the building were destroyed by water damage. Because the CE relied primarily on their electronic health records stored on an offsite server, medical data was still intact for continuity of care purposes. The CE provided breach notification to individuals, HHS, and the media, and posted substitute notice on its website. The CE has since moved its school-based operations to a CE owned facility. OCR obtained assurances that the CE implemented the corrective action listed above.