On March 17, 2015, the covered entity (CE) learned that a box containing health insurance claim forms was damaged by a Federal Express (FedEx) hub in Memphis, Tennessee. The protected health information (PHI) involved in the breach included the names, addresses, dates of birth, genders, diagnosis codes, procedure codes, insurance identification numbers, and some social security numbers of 2,584 individuals. Through retained legal counsel the CE investigated the incident to determine what and how many forms were missing, and to retrieve as many missing forms as possible. The CE provided breach notification to HHS, affected individuals, and the media, and offered one year of credit protection to affected individuals. Additionally, the CE decreased the size of batch mailings to limit the potential size of a data breach associated with a lost or damaged box. OCR obtained assurances that the corrective actions were taken.
