Jeffrey D. Rice, O.D

Jeffery D. Rice, O.D./Vision Source, the covered entity (CE), reported that, on or about December 12, 2016, seven boxes that contained past and current patients’ protected health information (PHI) were stolen from a warehouse. This breach affected approximately 1,586 individuals. The types of protected health information (PHI) involved in the breach included contained names, address, social security numbers, and medical diagnoses/conditions. Following the breach, the CE inventoried the storage unit to note what was missing, informed the police of the theft, recovered the stolen PHI, reviewed the recovered PHI, and moved their offsite PHI to a new location. The CE provided breach notification to HHS and affected individuals. In response to OCR’s investigation the CE revised its policies for uses and disclosure of PHI policy and for safeguarding PHI and trained its staff on these updated policies. The CE also trained an employee to regularly check on the PHI that is stored off site. OCR obtained documentation of all actions taken in this matter.