Dermacare Brickell

On November 20, 2018, the covered entity (CE), Dermacare Brickell, discovered that patient files in a locked storage unit had been disposed of inadvertently. The files contained the protected health information (PHI) of 1,800 former patients and included demographic and clinical information. The CE provided breach notification to HHS, affected individuals, and the media and posted notice on its website. It also set up a toll-free phone number to respond to inquiries. In response to the incident, the CE conducted a full review of the incident, revised its HIPAA policies, including the physical safeguards requirements, and trained its staff on its updated policies. OCR obtained assurances the CE implemented the corrective actions listed above.