Roark's Pharmacy

The covered entity (CE), Roark’s Pharmacy, discovered on January 13, 2016, that its facility had been broken into and computer hard drives containing the protected health information (PHI) of 3,000 individuals were stolen. The types of PHI on the hard drives included patients' names, dates of birth, addresses, diagnoses, conditions, medications, health insurance information, and social security numbers (when used as ID numbers for certain insurance carriers). The CE provided breach notification to HHS and to affected individuals. OCR provided technical assistance to the CE regarding the Breach Notification Rule and impermissible disclosures. In addition, OCR provided resource materials regarding small businesses and the Privacy and Security Rules. In response to the breach, the CE increased its physical security by installing a metal gate over its front door, improving its security alarm system, and physically hiding and securing sensitive equipment. OCR obtained assurances that the CE implemented the corrective actions listed above.