HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Feb. 19, 2016.
- Organization as reported
- Roark's Pharmacy, TN
- Entity type as reported
- Healthcare Provider
- Category as reported
Theft
- Location of information as reported
- Network Server
- Submission date
- Feb. 19, 2016
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14613, row:5752)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE), Roark’s Pharmacy, discovered on January 13, 2016, that its facility had been broken into and computer hard drives containing the protected health information (PHI) of 3,000 individuals were stolen. The types of PHI on the hard drives included patients' names, dates of birth, addresses, diagnoses, conditions, medications, health insurance information, and social security numbers (when used as ID numbers for certain insurance carriers). The CE provided breach notification to HHS and to affected individuals. OCR provided technical assistance to the CE regarding the Breach Notification Rule and impermissible disclosures. In addition, OCR provided resource materials regarding small businesses and the Privacy and Security Rules. In response to the breach, the CE increased its physical security by installing a metal gate over its front door, improving its security alarm system, and physically hiding and securing sensitive equipment. OCR obtained assurances that the CE implemented the corrective actions listed above.