KidsPeace

The covered entity (CE), Kids Peace, discovered that a box of documents from the medical records department was missing. It is believed that a custodian threw the box, which was left next to a wastepaper basket, in the trash. The breach included the protected health information (PHI) of 1,456 individuals and included names, dates of birth, medical record and patient account numbers, and service dates. Following the breach, the CE retrained staff and restricted custodians’ access to the medical records department. Additionally, OCR reviewed the CE’s risk analysis to ensure compliance with the Security Rule. OCR obtained assurances that the CE implemented the corrective actions listed above.