Rite Aid Store 5256

A box containing paper prescription records was removed from the backroom at the covered entity’s (CE) Milton, WA location. The box contained the protected health information (PHI) of approximately 522 individuals and included names, addresses, and dates of birth. The CE provided breach notification to affected individuals, HHS, and the media. The CE offered one year of free identity theft protection to affected individuals. Following the breach, the CE improved physical safeguards by moving all remaining hard copy prescription records to a more secure area. The CE contacted all other stores in the region to ensure that prescription records were being appropriately secured. As a result of OCR’s investigation, the CE clarified its PHI storage policies to store managers in Washington State, and implemented new security procedures at the affected location. OCR provided the CE with technical assistance regarding adequate safeguards to PHI, as well as what constitutes adequate notice to the media pursuant to the Breach Notification Rule.