Echo Canyon Healthcare

On March 22, 2018, the covered entity (CE) discovered that a locked storage area was burglarized that contained boxes with old invoices containing protected health information (PHI), potentially affecting approximately 1,765 individuals. The types of PHI included demographic and clinical information, and for 24 individuals, pictures, social security numbers, Medicare numbers and financial information. The CE provided breach notification to HHS, affected individuals, and the media and also posted notice on its website, provided a dedicated a telephone number and email address for additional information about the breach, and offered complimentary credit monitoring for the individuals with financial information potentially disclosed. The CE provided onsite HIPAA training to all the workforce members on the issues raised in the breach. OCR provided substantial technical assistance to the CE and obtained assurances that the CE implemented the corrective actions noted above.