Courier Corporation of Hawaii

Documents containing the protected health information (PHI) of 3,959 Kaiser Permanente patients, spilled onto the highway when the business associate (BA), Courier Corporation of Hawaii, transported the covered entity’s (CE) documents to storage. Many but not all of the documents were retrieved from the road. The types of PHI involved in the breach included names, addresses, dates of birth, driver’s license information, social security numbers, and other identifiers. The CE provided breach notification to HHS, affected individuals, and the media, and provided affected individuals with free credit monitoring. To prevent a similar breach from happening in the future, the CE and BA retrained staff on HIPAA requirements, revised policies and procedures, and sanctioned workforce members (including termination). The CE and BA also took steps to mitigate harm. As a result of OCR’s investigation, OCR obtained assurances that the notifications and corrective actions listed above were completed.