The covered entity (CE), The Kroger Company, reported that a shipping service lost a box of patient records containing the protected health information (PHI) of approximately 4,812 individuals. The records were being shipped from its off-site storage facility; however, the off-site storage vendor shipped more than the PHI requested. The PHI involved included names, prescription numbers, and health insurance information. The CE notified HHS, affected individuals, the media, and provided a toll-free number for questions or concerns. The CE implemented additional administrative safeguards and retrained its staff. OCR obtained documentation that the CE implemented the corrective actions noted.
