HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of Oct. 18, 2016.
- Organization as reported
- Four Star Drug of Bethany, Inc., NE
- Entity type as reported
- Healthcare Provider
- Category as reported
Improper Disposal
- Location of information as reported
- Paper/Films
- Submission date
- Oct. 18, 2016
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14390, row:5529)
- Archived copy
- Held in the private archive (provenance)
On August 30, 2016, the covered entity (CE), Four Star Drug of Bethany, Inc., discovered that it left boxes containing protected health information (PHI) outdoors in an unprotected area where a garbage truck eventually retrieved the boxes and transported them to a recycling plant. The breach affected the PHI of approximately 647 individuals and included patients’ names, dates of birth, social security numbers, clinical and demographic information, claims information, and medications. The CE provided breach notification to HHS, affected individuals, and the media. The CE further advised HHS that on May 24, 2016, its pharmacy department was sold, and consequently it was closed at the time of the breach incident that occurred on August 30, 2016. Following the breach, the CE updated its HIPAA policies and procedures to ensure that its remaining records that contain PHI are safeguarded and disposed of properly. The CE no longer generates records containing PHI because it is closed. OCR obtained documented assurances that the CE implemented the corrective actions listed above.