EMERGENCY COVERAGE

On September 5, 2017, Emergency Coverage Corporation, the covered entity (CE), discovered that two boxes of remittance advice forms fell off the back of a UPS truck. The types of protected health information (PHI) included on the forms were patients’ names, addresses, dates of birth, health insurance policy numbers, diagnostic codes, a description of the services rendered, and full or partial social security numbers. The breach affected 730 individuals. The CE provided breach notification to HHS and the affected individuals. Media notification was not required as less than 500 affected individuals resided in a single geographic region. In response to the breach, the CE reviewed its policies and procedures, performed a risk assessment, and offered identity theft insurance coverage to the affected individuals. OCR obtained assurances that the CE implemented the corrective actions listed above.