Three Lower Counties Community Services

The covered entity (CE), Three Lower Counties Community Services dba Chesapeake Health Care, reported that patients were able to access the protected health information (PHI) of 2,505 individuals while using the CE’s iPads to complete registration documents. The PHI involved includes names, addresses, dates of birth, x-rays, and other treatment information. The CE notified HHS, affected individuals the media, and posted substitute notice on its website. In response to the breach, the CE discontinued patient use of the iPads and retrained its employees on patient privacy.