Lancaster General Medical Group

A spreadsheet containing the protected health information (PHI) of 527 individuals was stolen from one of the covered entity's (CE) locations. The PHI involved in the breach included names and dates of birth. Following the breach, the CE notified the local police, provided breach notification to HHS, the media, and the affected individuals, and offered identity protection services to the individuals. The CE attempted to retrieve the PHI. As a result of OCR's investigation, the CE reviewed its policies to prevent a similar incident from occurring in the future. \ \ \