Allina Health System-Minneapolis Heart Institute, the covered entity (CE), discovered that protected health information (PHI) was placed in a recycling bin and emptied, instead of being shredded as planned. The breach was discovered on January 20, 2017, and affected approximately 776 individuals. The types of PHI involved included names, addresses, dates of birth, social security numbers, Medicare identification numbers, insurance identification numbers, clinical diagnoses, and lab results. The CE provided breach notification to affected individuals, HHS and the media. Following the breach, the CE implemented new policies and procedures and trained employees. OCR obtained assurances that the CE implemented the corrective actions noted above.
