Adventist Health Physician Services

The covered entity (CE), Adventist Health Physician Services, reported that an employee impermissibly disposed of medical records in a trash receptacle. This breach affected approximately 3,797 individuals. The PHI involved included names, addresses, birthdates, drivers’ license information, Social Security numbers, diagnoses, lab results, and medications prescribed. The CE notified HHS, affected individuals, the media, and provided substitute notice on its website. In addition, Adventist Health Physicians Services offered complimentary credit monitoring services as well as a toll-free number for questions or concerns. In its mitigation efforts, the BA implemented additional administrative and technical safeguards and retrained its staff. The responsible employee was also sanctioned. OCR obtained assurances that the CE implemented the corrective actions noted.