HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of July 24, 2020.
- Organization as reported
- CVS Pharmacy, RI
- Entity type as reported
- Healthcare Provider
- Category as reported
Loss
- Location of information as reported
- Paper/Films
- Submission date
- July 24, 2020
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 12776, row:3915)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE), CVS Pharmacy, reported that a number of its CVS stores across the country had been vandalized. The breach affected the protected health information (PHI) of 26,234 individuals. The PHI involved included names, addresses, and dates of birth, as well as clinical information including medications prescribed. The CE notified HHS, affected individuals, the media, and provided substitute note. Following the breach, CVS assembled a response team to investigate and restore operations, and provided its pharmacy teams with additional guidance and recommendations for securing PHI that had been tampered or removed. In its mitigation efforts, the CE implemented additional physical, administrative, technical, and security safeguards to better protect its PHI. CVS apologized to all affected individuals and provided a toll-free phone number to call with questions or concerns.