Reading Health System

A medical practice moved and a vendor/patient stored three boxes of paper medical billing records in the vendor’s crawl space from March 2012 until March 2014. The boxes contained the protected health information (PHI) of approximately 1,845 individuals. The types of PHI involved in the breach included names, addresses, dates of birth, social security numbers, insurance information, medical practice billing codes, and diagnoses. Following the breach, the covered entity (CE), Reading Health System, interviewed the vendor/patient and determined no disclosures had occurred. The CE provided breach notification to HHS and affected individuals and offered all living patients a year of free credit monitoring. The CE established a professionally staffed call