The Kroger Co., for itself and its affiliates and subsidiaries

About this report

The covered entity (CE), The Kroger Company, reported that a shipping service lost a box of patient records containing the protected health information (PHI) of approximately 4,812 individuals. The records were being shipped from its off-site storage facility; however, the off-site storage vendor shipped more than the PHI requested. The PHI involved included names, prescription numbers, and health insurance information. The CE notified HHS, affected individuals, the media, and provided a toll-free number for questions or concerns. The CE implemented additional administrative safeguards and retrained its staff. OCR obtained documentation that the CE implemented the corrective actions noted.

Summary as published by the HHS Office for Civil Rights.