CVS Health Store 3976, the covered entity (CE), was looted and burned during rioting activity that occurred in the city of Baltimore, Maryland, and some computers containing electronic protected health information (ePHI) were stolen. 12,914 individuals were affected by the incident. The specific type of PHI on the stolen computers included patients’ first and last names, partial dates of birth, addresses, medication names, medication dosage, and prescription number. CVS Health provided OCR with assurances that individuals affected by this breach and the media were notified in accordance with the Breach Notification Rule. All individuals affected by the breach were given 1 year of free credit monitoring by the CE.
