Tomah Memorial Hospital

A nurse impermissibly used the protected health information (PHI) of approximately 600 patients to obtain narcotics from the covered entity (CE), Tomah Memorial Hospital, for her own use. The PHI involved in the breach included patients’ names and account numbers. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE improved safeguards by creating a monthly audit of Schedule II narcotics, matched to the dispense log, medical order, and bill. OCR obtained assurances that the CE implemented the corrective actions listed above. The CE also terminated the involved employee’s employment.