Keystone Rural Health Consortia

A former employee stole a printout of a patient listing created in January 2015 that was hanging in the locked medical records room and used the information to send letters to several patients. The breach included the protected health information (PHI) of approximately 800 individuals and included demographic information, dates of birth, insurance information, and providers' names. The covered entity (CE), Keystone Rural Health Consortia, Inc., provided breach notification to HHS, affected individuals, and the media. OCR reviewed the CE’s most recent risk analysis to ensure compliance with the Privacy and Security Rules and obtained assurances that the CE strengthened physical safeguards to prevent similar occurrences in the future.