VHS Genesis Lab

The covered entity (CE), VHS Genesis Lab, Inc., misplaced a month’s worth of client invoices which were never located. The invoices contained the protected health information (PHI) of over 500 individuals and included names, dates of birth, and medical testing information. The CE provided breach notification to HHS, affected individuals and the media, and placed notice on its website. Following the breach, the CE arranged for a business associate to handle the mailing of invoices. OCR obtained assurances that the CE implemented the corrective actions listed above.