AdventHealth Rollins Brook Hospital

The covered entity’s (CE's) Trauma Department misplaced a binder containing the emergency room statistics of 5,000 patients who had visited the emergency room in 2017, including demographic and clinical information. The CE conducted a breach assessment of the incident and concluded that during an internal move of the Trauma Coordinator’s physical office, hospital staff may have unintentionally disposed of the binder. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE strengthened its safeguards policy and procedure, enhanced its process for requesting relocation of equipment, and trained staff on the enhanced policies and procedures. The CE also provided evidence of its existing maintenance of records policy and procedure that outlined the ownership, maintenance, confidentiality, retention, and destruction of records containing protected health information. OCR obtained assurances that the CE implemented the voluntary corrective actions noted above.