The covered entity (CE), CVS Pharmacy, reported that a number of its CVS stores across the country had been vandalized. The breach affected the protected health information (PHI) of 26,234 individuals. The PHI involved included names, addresses, and dates of birth, as well as clinical information including medications prescribed. The CE notified HHS, affected individuals, the media, and provided substitute note. Following the breach, CVS assembled a response team to investigate and restore operations, and provided its pharmacy teams with additional guidance and recommendations for securing PHI that had been tampered or removed. In its mitigation efforts, the CE implemented additional physical, administrative, technical, and security safeguards to better protect its PHI. CVS apologized to all affected individuals and provided a toll-free phone number to call with questions or concerns.
