Individual(s) broke into the offices of the covered entity (CE), Madison Street Provider Network (doing business as Spivack Vision Center), and searched the locked cabinets and drawers inside the facility’s medical records room. The CE found no evidence that any medical records were taken or disturbed during the break-in. The breach affected 9,129 individuals. The CE provided breach notification to HHS, affected individuals, and the media. The CE investigated the incident and mitigated the effects of the breach by providing identity repair and credit monitoring services to affected individuals for one year. In addition, the CE removed all paper medical records from the office location, securely disposed of certain records, and stored the remaining paper records in an off-site, secure storage facility. OCR provided the CE with technical assistance during the investigation, reminding it to ensure it has a business associate agreement in place with the secure storage facility.
