PHI of over 12,000 New York Pharmacy Customers Exposed Due to Improper Disposal

by | Dec 6, 2017

ShopRite Supermarkets, Inc., has revealed that some of its clients have been impacted by a security breach following the improper disposal of a device used to record customers’ signatures.

The device was stolen from the ShopRite outlet at Kingston, NY  between 2005 and 2015 and held personal and medical information. Clients who visited the pharmacy and had prescriptions completed between 2005 and 2015 have possibly been impacted by the incident. For those clients, the device stored information inluding names, phone numbers, prescription details, dates and times of pickup or delivery, zip codes, medication names, and copies of customers’ signatures.

The device was also used for clients who purchased an over-the-counter product containing pseudoephedrine. Those clients have had their driver’s license number, zip code, details of the product bought, and personal and medical data exposed.

In the substitute breach notice published on the Wakefern Food Corp., website, customers have been told that the device was disposed of by mistake in February 2016, although ShopRite only revealed that a data security incident had happened on October 13, 2017.

ShopRight has not had any indication that the device has been accessed or misused in any way, although customers have been told to monitor their Explanation of Benefits statements from their insurers for any sign of improper use of their data. Customers have also been told to monitor their financial accounts for any evidence of fraud, although ShopRite does say that their Social Security numbers and financial data were not accessible at any point.

ShopRite has reacted to the incident by reviewing its security measures in relation to devices that store personal data and the removal and secure deletion of data from those devices prior to their disposal. Further privacy and security training has also been given to all pharmacy staff to help avoid further security breaches of this nature.

All clients affected by the security breach have now been advised by mail. The breach report filed to the Department of Health and Human Services’ Office for Civil Rights indicates 12,172 clients have been affected.

Raise the level of HIPAA Awareness in your organization with Learner-Friendly, Comprehensive and Affordable HIPAA Training.


Please enable JavaScript in your browser to complete this form.

Patrick Kennedy

Patrick Kennedy is a highly accomplished journalist and editor with nearly two decades of experience in the field. With expertise in writing and editing content, Patrick has made significant contributions to various publications and organizations. Over the course of his career, Patrick has successfully managed teams of writers, overseeing the production of high-quality content and ensuring its adherence to professional standards. His exceptional leadership skills, combined with his deep understanding of journalistic principles, have allowed him to create cohesive and engaging narratives that resonate with readers. A notable area of specialization for Patrick lies in compliance, particularly in relation to HIPAA (Health Insurance Portability and Accountability Act). He has authored numerous articles delving into the complexities of compliance and its implications for various industries. Patrick's comprehensive understanding of HIPAA regulations has positioned him as a go-to expert, sought after for his insights and expertise in this field. Patrick's bachelors degree is from the University of Limerick and his master's degree in journalism is from Dublin City University. You can contact Patrick through his LinkedIn profile:

Raise the level of HIPAA Awareness in your organization with Learner-Friendly, Comprehensive and Affordable HIPAA Training.

Comprehensive HIPAA Training

Used in 1000+ Healthcare Organizations and 100+ Universities

    Full Course - Immediate Access

    Privacy Policy