In early April 2015, while performing a non-routine pharmacy audit, the covered entity (CE), Sioux Falls Veterans Administration Health Care System, discovered that paper prescription records were missing from its secured vault; it was unable to determine what happened to the records, so it reported a breach. The missing records affected 1,111 individuals, and contained clinical and/or demographic protected health information (PHI). The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE discontinued attaching progress notes with full social security numbers. The CE also implemented an inventory for pharmacy records, removed obsolete language from its procedures regarding the Breach Notification Rule, and trained all relevant staff on safeguarding paper records containing PHI and timely discovery and notifications. OCR obtained assurances the CE implemented the corrective actions noted above.
