HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of July 30, 2014.
- Organization as reported
- Rite Aid Store 5256, WA
- Entity type as reported
- Healthcare Provider
- Category as reported
Theft
- Location of information as reported
- Paper/Films
- Submission date
- July 30, 2014
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15030, row:6169)
- Archived copy
- Held in the private archive (provenance)
A box containing paper prescription records was removed from the backroom at the covered entity’s (CE) Milton, WA location. The box contained the protected health information (PHI) of approximately 522 individuals and included names, addresses, and dates of birth. The CE provided breach notification to affected individuals, HHS, and the media. The CE offered one year of free identity theft protection to affected individuals. Following the breach, the CE improved physical safeguards by moving all remaining hard copy prescription records to a more secure area. The CE contacted all other stores in the region to ensure that prescription records were being appropriately secured. As a result of OCR’s investigation, the CE clarified its PHI storage policies to store managers in Washington State, and implemented new security procedures at the affected location. OCR provided the CE with technical assistance regarding adequate safeguards to PHI, as well as what constitutes adequate notice to the media pursuant to the Breach Notification Rule.