Rite Aid Store 01617

From November 19, 2014, through November 18, 2015, an employee of the covered entity (CE), Rite Aid Pharmacy Store 01617, obtained customers’ credit card information along with other personal identifiers, which he used to commit credit card fraud. The incident affected 976 individuals. The electronic protected health information (ePHI) involved included patients’ names, addresses, dates of birth, and credit card information. As a result of the breach, the CE conducted an internal investigation, sanctioned the employee responsible for the incident, and revised its policy regarding handling of payment cards. The CE provided breach notification to HHS, affected individuals, and the media and provided one year free of credit monitoring services. OCR provided the CE with technical assistance regarding the requirements of the HIPAA Security Rule with respect to risk analyses, development of risk management plans, and implementation of procedures to review records of information system activity, grant access to ePHI, and deploy audit controls. In this case, employee sanctions included termination of employment.