CVS Health cvs.com CVS Health data breach: what happened and what to do
In January 2017, a box of hard copy prescriptions was stolen from a CVS pharmacy in Michigan City, Indiana. HHS lists 724 people affected, with names, dates of birth, addresses and medication details.
View all 13,177 breaches- Breach date
- 11 Jan 2017
- Affected
- 724
- Data exposed
- Names, Dates of birth, Physical addresses, Medication names, Medication dosages, Prescription numbers, Prescriber information
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
On January 11, 2017, a box of paper controlled substance prescriptions was stolen from a CVS pharmacy in Michigan City, Indiana. The prescriptions had been written between January 2 and January 11, 2017.
The U.S. Department of Health and Human Services (HHS) lists the case with 724 people affected. According to its description, the information involved was patients' names, dates of birth, addresses, medication names, medication dosages, prescription numbers and prescriber information. It does not list Social Security numbers or payment cards.
CVS notified the affected people, the media and HHS. After the theft, the company retrained staff at the Michigan City location. Management also audited the store to make sure patient records were not easily visible to waiting customers or reachable by anyone standing outside the pharmacy. HHS's Office for Civil Rights reviewed CVS's policies on safeguarding health information and obtained assurances that those corrective actions were in place.
The risk here is mostly about privacy and targeted fraud. Medication names and doses reveal health conditions, and a prescription number with a name and date of birth could be used to pose as the pharmacy or your doctor in a phone call or letter. Controlled substance prescriptions are also what makes this kind of theft attractive to the person taking them.
HHS lists the case as closed.
Sources checked: ocrportal.hhs.gov, identitytheft.gov
Last verified against the official page:
What to do if you were in it
- 1
Read the notice you received
Affected patients were notified by mail. If you got one, keep it. It describes what was on the prescriptions and who to contact at CVS.
- 2
Be cautious with calls about your prescriptions
If someone calls or writes about a prescription and asks for personal details, hang up and call the pharmacy on a number from its website or your bottle label.
- 3
Review your health insurance statements
Look at explanation of benefits statements for services or medicines you didn't get, and report anything odd to your insurer.
- 4
Learn what to do after any breach
The FTC walks through steps by data type at https://www.identitytheft.gov/databreach.
- 5
Check whether your email or phone is in this and other breaches
Serus runs a free scan that checks breach databases and the dark web for your email and phone number and alerts you if they show up. It detects and alerts; it can't remove data from a breach.
Official filings
- U.S. Department of Health and Human Services , filed 8 Mar 2017 : 724 people
- U.S. Department of Health and Human Services , filed 5 Dec 2016 : 626 people
Timeline
-
Reported to U.S. Department of Health and Human Services
-
The breach happened
-
Reported to U.S. Department of Health and Human Services
Frequently asked
Was I affected by the CVS breach?
HHS lists 724 people. Notices went out to those patients. If you filled controlled substance prescriptions at the Michigan City, Indiana store in early January 2017, check your mail from that time.
What was exposed?
Names, dates of birth, addresses, medication names, medication dosages, prescription numbers and prescriber information.
Were Social Security numbers exposed?
HHS's description doesn't list Social Security numbers.
Is there a settlement?
HHS's entry doesn't mention one. It says OCR obtained assurances that CVS made corrective changes.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
