Oak Cliff Orthopaedic Associates

On October 17, 2016, the covered entity (CE), Oak Cliff Orthopaedic Associates, received a call from the local police stating that two boxes with protected health information (PHI) pertaining to its patients were recovered from a hotel located in Texas. The boxes contained patients’ demographic, financial, and clinical information. The CE filed a police report and retrieved the boxes from the police department the next day. On Dec. 9, 2016, the CE contracted with a third-party vendor to mail breach notification to the affected individuals. The CE completed media notification and offered the affected individuals one (1) year of free identity theft protection services. In addition, it set up a call center to assists individuals with questions. The CE also improved physical security. OCR provided technical assistance regarding business associates and obtained documented assurances that the CE implemented the corrective actions noted above.