Unconditional Love, Incorporated

The covered entity (CE) discovered that someone had broken into two of its steel storage units which housed boxes of old files containing the protected health information (PHI) of 643 individuals. The boxes containing PHI were not visibly opened, moved, or disturbed in any way, but one box had been placed on a table. The types of PHI involved in the incident included names, dates of birth, addresses, diagnoses, social security numbers, and some accounts payable information. In response to the breach, the CE implemented additional safeguards. The CE provided breach notification to HHS, affected individuals, and the media and posted substitute notice on its website. The CE updated its HIPAA Privacy Rule policies & procedures and retrained its staff. OCR obtained assurances that the CE implemented the corrective actions listed above.