Lincoln County Health and Human Services/Lincoln Community Health Center

The covered entity’s (CE) locked building was burglarized and a locked medical chart room containing protected health information (PHI) in paper form was broken into and accessed by an unknown person(s). No PHI was removed and forensics determined there were no attempts to access electronic PHI on the CE’s computers. The medical charts potentially accessed included names, dates of birth, addresses, social security numbers, financial information, medications, treatment information, and lab results for 956 individuals. The CE improved physical safeguards by repairing or replacing the broken locks and adding a security camera. OCR’s investigation confirmed that the appropriate breach notifications were made and that corrective actions steps were taken. OCR also required the CE to update its breach notification policies and procedures, and retrain its staff on its revised policies.