Miami VA Healthcare System

A covered entity's (CE) pharmacy log book, containing the protected health information (PHI) of 568 individuals, was misplaced and never recovered. The PHI affected by the breach included names and partial social security numbers. Following the breach, the CE provided breach notification as required by the HIPAA Breach Notification Rule and instructed employees to cease the practice of keeping log books. Following OCR's investigation, the CE revised and/or updated its policies and procedures with respect to safeguarding PHI. Regarding logbooks, it established a written employee agreement, implemented an employee authorization process, and established safeguards. Additionally, the CE provided training to all staff in the pharmacy department regarding the use of logbooks and accounted for the disclosures in each of the affected individuals' accounting log.