Prima CARE

Two binders belonging to a former employee were discovered at Dave’s Beach in Fall River, MA on May 25, 2015. The binders contained the protected health information (PHI) of 1,651 patients of the covered entity (CE), Prima Care, P.C. The PHI predominantly consisted of names, dates of birth, diagnoses, admission and treatment dates, medical record numbers, and hospital account number. For three individuals, the PHI also included partial or complete social security numbers. The CE provided breach notification to HHS, affected individuals, and the media. It also provided a dedicated telephone number for questions and free credit monitoring services to those with breached social security numbers. As a result of the breach and OCR’s investigation, the CE revised its policies and procedures related to uses and disclosures of PHI, safeguards, and the minimum necessary standard.