Indian Health Service -Rosebud

The covered entity (CE), Indian Health Service IHS), Rosebud Service Unit, reported that on May 30, 2014, its employee left a folder of records containing protected health information (PHI) in a public restroom at the IHS’ Rapid City Hospital when she was at the hospital for a meeting. The folder contained the records of 620 individuals and included patient names and social security numbers. The CE provided breach notification to HHS, affected individuals, and the media and also offered credit monitoring and identity theft insurance to affected individuals. Following the breach, the CE sanctioned the employee. OCR obtained written assurances from the CE that it will implement policies and procedures regarding breach notification and mitigation in accordance with the technical assistance provided by OCR pursuant to this investigation.