Cumberland Gastroenterology, P.S.C

The covered entity's (CE) medical records storage facility was burglarized, resulting in the theft of protected health information (PHI) of 2,207 individuals. The PHI included names, birth dates, social security numbers, addresses, phone numbers, primary care providers, diagnosis codes, presenting complaints, exam findings, insurance information, dates of visits, services performed, and referring providers. The CE filed a police report and provided breach notification to affected individuals, HHS, and the media. The CE also conducted an inventory of stolen items and created an accounting of affected individuals. Following the breach, the CE increased physical security, limited the amount of stored PHI, and expedited the adoption of electronic medical records. As a result of OCR's investigation the CE executed BA agreements with the storage facility and with a document shredding company. Additionally, it re-trained workforce members on its revised HIPAA policies and procedures with respect to safeguards for PHI, and placed an accounting of disclosures of PHI in each of the affected individuals' medical records. OCR obtained assurances that the CE implemented the corrective action li