HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of March 8, 2017.
- Organization as reported
- CVS Health, RI
- Entity type as reported
- Healthcare Provider
- Category as reported
Theft
- Location of information as reported
- Paper/Films
- Submission date
- March 8, 2017
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14248, row:5387)
- Archived copy
- Held in the private archive (provenance)
On January 11, 2017, a box containing hard copy controlled substance prescriptions written between January 2, 2017 and January 11, 2017, was stolen by an unknown individual from a CVS, the covered entity (CE), in Michigan City, Indiana. The breach affected 724 individuals and the types of protected health information (PHI) involved included patients’ names, dates of birth, addresses, medication names, medication dosages, prescription numbers, and prescriber information. The CE provided breach notification to affected individuals, the media, and HHS. Following the breach, the CE retrained its staff at the Michigan City location. Additionally, the CE’s management conducted an internal audit to ensure that patient records were not easily visible to waiting customers or accessible by anyone standing outside of the pharmacy. OCR reviewed the CE’s policies and procedures on uses and disclosure of PHI and safeguarding PHI and obtained assurances that the CE implemented the corrective actions noted above.