Coastal Behavioral Healthcare

OCR opened an investigation of the covered entity (CE), Coastal Behavioral Healthcare, Inc., after it reported that four pages containing protected health information (PHI) were recovered by local law enforcement during a motor vehicle traffic stop. The CE indicated the four pages were likely part of a larger report and may have containing the PHI of 4,907 individuals. The PHI involved in the breach included names, social security numbers, dates of birth, and other identifiers. The CE provided breach notification to the affected individuals, HHS, and the media. Following the breach, the CE hired a cybersecurity firm to perform a network audit and to conduct a security risk assessment. The CE also improved safeguards by restricting physical access to its information technology department, implementing a new electronic health record system, and disabling the ability to print reports from its database containing data similar to the report that was the subject of the breach. OCR obtained assurances that the CE implemented the corrective action listed above.