Reconstructive Orthopaedic Associates II

An employee removed paper copies of daily patient schedules and two medical reports from the covered entity's (CE) transcription processing department without authorization upon her termination from employment. Approximately 2,300 individuals were affected by the breach. The protected health information (PHI) involved in the breach included patient names, telephone numbers, appointment dates and times, dates of birth, reasons for visits, visit sites, assigned staff/physician, chart numbers, insurance company codes and copays, encounter numbers, and treatment information. The CE provided breach notification to HHS, the media and affected individuals and provided one year of free credit monitoring to those requested it. Following the breach, the CE cooperated with local authorities in their arrest and prosecution of the involved employee. The CE updated its privacy policies and procedures, organized the policies into a HIPAA manual, and retrained 687 employees on its privacy policies and procedures. In response to OCR's investigation, the CE decided to replace its electronic medical records and practice management systems to improve safeguards for electronic PHI.