A patient, Ms. Snodrey, was given a CD with PHI to take to her doctor's office out of town. Unfortunately, the CD contained another patient's PHI. Ms. Snodrey realized the error and contacted the hospital to let us know of the incident. A meeting was scheduled with Ms. Snodrey, and she was asked to bring the CD to the meeting. Ms. Snodrey did not have the CD at the meeting and is refusing to return the CD without financial compensation. Ms. Snodrey was advised, as per our attorney, there was no process under the privacy regulations that would award any financial compensation for return of the PHI. The patient threatened to view the PHI on the CD and call the person whose PHI is on the CD so that patient could file a lawsuit. The patient said they were not holding the CD for "ransom" but needs to figure out how much money they deserved for the CD and the problems it caused her. The patient said her salary should be compensated because of a delay in treatment, and there should be compensation for the error. The patient was again asked to return the CD at which time she indicated that she was going to the Chief Executive Officer (CEO) of the hospital. She will not return the CD until a reward amount that is suitable to her is paid. We are going to report this as a breach. We do not know whose PHI is on the CD. What do we do about patient notification in that case? What recourse do we have since the patient is in possession of "stolen property" and is demanding financial compensation for return of the CD?