CVS Pharmacy

An individual broke into a CVS Pharmacy in Riverview, Florida during Hurricane Irma and stole completed prescriptions intended for 836 individuals. The type of protected health information (PHI) stolen included patients' first and last names, dates of birth, addresses, medication names, and provider names. The CE assessed the damage and secured the store to prevent any other unauthorized access. OCR reviewed the CE's policies and procedures on uses and disclosure of PHI and safeguarding PHI and obtained assurances that the CE provided breach notification to affected individuals and the media in accordance with the Breach Notification Rule.