Lifetime Middleton

Lifetime Middleton, LLC, the covered entity (CE), reported that an employee took documents containing the protected health information (PHI) of 1,900 individuals prior to leaving its employment. The PHI involved included names, addresses, and financial information. The CE notified HHS, affected individuals, and the media. The CE also informed OCR that it contacted the former workforce member, who returned the list to the CE and certified that all copies of the data had been destroyed. OCR provided technical assistance to the CE regarding safeguards and the definition of a breach.