A staff member misplaced and was unable to recover a handwritten notebook in which the staff member maintained protected health information (PHI) for approximately 525 patients. The types of PHI included patients’ names, dates of births, addresses, social security numbers, telephone numbers, medical records numbers, health plan information, clinical information and dates of services. The CE provided breach notification to HHS, affected individuals and the media. Following the breach, the CE re-trained all staff regarding safeguarding PHI and advised staff that personal maintenance of patient information outside the covered entity’s electronic health record (EHR) system was prohibited, unless approved by management. In addition, the CE sanctioned the staff member and reprimanded the staff member’s manager. OCR obtained assurances that the CE implemented the corrective actions listed.
