Ron's Pharmacy Services

On February 8, 2017, Ron's Pharmacy Services, the covered entity (CE), identified unusual activity in an employee email account. The CE initiated an investigation and changed the employee’s email credentials. The CE's third-party forensic investigators determined that an individual(s) inappropriately accessed the employee’s email account. Within that employee’s email account was an email message containing protected health information (PHI) relating to 6,871 patients. The email included patients' names, internal account numbers, payment adjustment information and, for a small number of patients, prescription medication information. The CE provided breach notification to HHS, affected individuals, and the media pursuant to the Breach Notification Rule. Following the breach, the CE changed all passwords, updated its policies and procedures and retrained its workforce member. OCR obtained assurances that the CE implemented these voluntary corrective actions.