Thomasville Eye Center

The covered entity (CE), Thomasville Eye Center, discovered that one of its employees opened a credit account for a patient without authorization. The employee was able to access patient names, addresses, dates of birth, Social Security numbers, and billing information. Although the CE only knows of one patient being impacted, the employee accessed records of 11,137 individuals during her employment, all of whom may have been affected. The CE provided breach notification to HHS, the individuals who may have been affected, the media, and on its website. Following the breach, the CE retrained employees and revised policies and procedures to limit employee access to protected information. OCR obtained assurances that the CE implemented the corrective actions listed above. The CE also terminated the employee involved, notified local law enforcement, and the FBI.