John T. Melvin, M.D.& Associates

Medical records were stolen from an off-site storage facility of the covered entity (CE), John T. Melvin & Associates. The protected health information (PHI) involved in the breach included names, dates of birth, social security numbers, claim information, diagnoses/conditions, medications, lab results, and other treatment information for approximately 2,541 individuals. The CE provided breach notification to HHS, affected individuals, and the media. As a result of OCR’s investigation the CE changed its policies, so that all records are now kept on-site and all records are immediately shredded once the required retention time has elapsed, according to applicable state law.