The covered entity, DJO, which is a supplier of durable medical equipment, prosthetics, orthotics, and supplies, reported a breach incident affecting 1,203 individuals when its business associate (BA), Total Orthopedics, lost paper forms containing protected health information (PHI). The types of PHI involved in the breach included demographic and clinical information, product order dates, health insurers, and health insurance indemnification numbers (which could possibly match an individual’s social security numbers). The CE was unable to identify the individuals affected. It provided breach notification through substitute notice posted on its website, to the media, and to HHS. OCR obtained assurances that the CE and BA took voluntary corrective actions, including attempting to identify the affected individuals, retraining employees, giving additional training to the new BA employee working on behalf of the CE, adding controls for tracking forms delivered and picked-up, increasing audits, and monitoring the inventory received.
