R.O.A.D.S. Foundation

On January 4, 2017, the covered entity (CE), R.O.A.D.S. Foundation Inc., DBA R.O.A.D.S. Community Care Clinic, noticed the lock on its mailbox was broken and there were no contents inside the mail box. The CE determined that documents, including explanations of benefits from its contracted insurance companies, were lost or stolen during the incident. The breach affected approximately 670 patients. The types of protected health information (PHI) in the missing pieces of mail included patients’ names, claim numbers, service dates, various dollar amounts (including billed, allowed, deductible, coinsurance, paid, adjustment, withheld, code, and claim balance), and dates of birth for half of the affected individuals. The CE notified local law enforcement and the U.S. Postal Service (USPS), and in response to this incident, instructed USPS to hand-deliver its mail during business hours to a CE staff member. The CE provided breach notification to HHS, affected individuals, and the media. OCR obtained assurances that the CE implemented the corrective actions noted above.