Clinical Reference Laboratory, Inc.

Clinical Reference Laboratory, Inc. (KS) reported to HHS on 2015-04-28 a Loss affecting 864 individuals. A parcel sent to Massachusetts Mutual Life was opened and damaged by USPS during mailing. The parcel contained PHI including names, partial and full SSNs, dates of birth, and clinical test codes. OCR consolidated this with two similar breach reports into one compliance review. The CE concluded misuse risk was remote after USPS confirmed unmatched pages were shredded. Remediation included new privacy officer, HIPAA training, updated breach procedures, and a new secure PHI portal.

Clinical Reference Laboratory, Inc. (KS) reported to HHS on 2015-03-03 a Loss affecting 4,668 individuals. Breached information was located on Paper/Films. A mailed parcel was damaged and opened during transit by USPS, exposing PHI including names, dates of service, partial SSNs, and lab test types. Multiple breach reports involving the same CE and fact pattern were consolidated into one HHS investigation.

Clinical Reference Laboratory, Inc. (KS) reported to HHS on 2014-04-09 a Loss affecting 979 individuals. A parcel sent by the CE was damaged and opened during mailing by USPS, exposing PHI including names, dates of birth, partial Social Security numbers, and lab test types of individuals residing in multiple states. Breached information located on Paper/Films. Multiple breach reports involving the same CE and fact pattern were consolidated into one HHS investigation.

Clinical Reference Laboratory, Inc. (CRL) notified the New Hampshire Attorney General's Office on October 7, 2013, regarding a data breach affecting approximately 125,000 individuals. The incident involved unauthorized access to CRL's computer systems, resulting in the exfiltration of Protected Health Information (PHI) and personally identifiable information (PII), including Social Security numbers and driver's license numbers. CRL engaged forensic investigators and notified affected individuals.

Clinical Reference Laboratory, Inc. notified the New Hampshire Attorney General on October 3, 2013, regarding a breach affecting approximately 100,000 individuals. The incident involved unauthorized access to a database containing protected health information (PHI), names, and Social Security numbers. The laboratory engaged forensic investigators and implemented security controls to address the vulnerability.