During a traffic stop on April 12, 2018, VA Long Beach Police discovered that the covered entity’s (CE) workforce member, without authorization, had taken possession of protected health information (PHI). The workforce member had medical folders in his vehicle which contained the PHI of approximately 1,030 individuals. The PHI involved in the breach included names, addresses, dates of birth, social security numbers and clinical information. The CE provided breach notification to HHS, affected individuals, and the media. In response to the breach the CE trained workforce members and sanctioned the workforce member responsible for the breach. OCR obtained assurances that the CE implemented the corrective actions noted above. In this case, the workforce member's sanction involved termination of employment.
