Indian Health Service Northern Navajo Medical Center

Indian Health Services, Northern Navajo Medical Center, the covered entity (CE), reported that an employee took protected health information (PHI) and stored it in a public storage unit without authorization. The breach affected 7,721 individuals, and the types of PHI involved in the breach included patients’ names, health record numbers, social security numbers, dates of birth, and health insurance policy numbers. The CE provided breach notification to HHS, affected individuals, and the media. It also notified law enforcement. OCR obtained documented assurances from the CE that it implemented improved administrative and technical safeguards, revised HIPAA policies and procedures, and retrained staff.