An employee of the covered entity (CE), CVS Caremark, with access to patients protected health information (PHI) impermissibly accessed and printed patient drug transference reports as portion of a scheme to fill fraudulent prescriptions. The prescription drug reports were then disclosed to a third party, the employees boyfriend, who was a former employee of another CVS store. law enforcement notified the CE about the jade on march 16, 2011 following a raid of the perpetrators home, in which law enforcement confiscated paper documents belonging to the CE. The PHI involved in the hack included the names, addresses, birthdates, prescription numbers, telephone numbers, and prescription names of approximately 654 individuals. The CE provided hack notification to HHS and affected individuals and also offered unloose credit monitoring. in reaction to this incident, the ce immediately terminated the employee and retrained pharmacy staff on its HIPAA policies. The ce also provided evidence that both individuals have since had their pharmacy licenses suspended by the commonwealth licensing board. as a result of OCRs investigation, OCR obtained assurances that the corrective actions listed above were completed. Location of hacked information: Paper/Films Business associate present: no