Vision Care Specialists

Vision Care Specialists, Inc., the covered entity (CE), discovered that on or about May 20, 2017, its administrative office had been burglarized. The CE determined that paper records containing the protected health information (PHI) of 703 individuals were among the stolen items. The stolen PHI contained names, social security numbers, dates of birth, credit card and bank account numbers, information on diagnoses and conditions, and other treatment information. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE implemented a clean desk policy, installed surveillance equipment at all of its locations, and improved physical security. The CE also revised its procedures to limit the use of paper records and, when paper records are necessary, to store them securely. OCR obtained assurances that the CE implemented the corrective actions listed.