HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of Dec. 5, 2016.
- Organization as reported
- CVS Health, RI
- Entity type as reported
- Healthcare Provider
- Category as reported
Theft
- Location of information as reported
- Paper/Films
- Submission date
- Dec. 5, 2016
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14339, row:5478)
- Archived copy
- Held in the private archive (provenance)
An individual broke into a CVS Pharmacy in Whiteville, NC during Hurricane Matthew. The thief stole 626 individuals' completed prescriptions. The types of PHI on the prescriptions included names, partial birthdates, addresses, medication names and doses, providers' names, and prescription numbers. The covered entity (CE) provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE assessed the damage and secured the store to prevent any other unauthorized access. OCR reviewed the CE's policies and procedures on uses and disclosure of PHI and safeguarding PHI, and determined that they were in compliance with the Privacy Rule. OCR obtained assurances that the CE implemented the corrective actions noted above.