Endocrinology Associates

OCR opened an investigation of Endocrinology Associates, the covered entity (CE), after it reported that on June 15, 2015, and June 19, 2015, it discovered that an unauthorized individual had broken and removed the lock securing a portable on demand (POD) storage container that held the protected health information (PHI) of approximately 1,400 individuals. The PHI included individuals’ names, addresses, dates of birth, social security numbers, lab results, diagnoses, and clinical information. The CE provided notification of the breach to the individuals affected by the breach, HHS, and the media. Following the breach, the CE reported the incidents to the local police department, enhanced the physical safeguards applied to the POD storage container, and retrained workforce members on its HIPAA policies and procedures. OCR obtained assurances that the CE implemented the corrective actions listed.