Arthritis & Osteoporosis Consultants of the Carolinas

On September 10, 2018, an employee of the covered entity (CE), Arthritis and Osteoporosis Consultants of the Carolinas, improperly disposed of protected health information (PHI) in a trash can instead of the shred bin. The breach affected 3,930 individuals and included patients’ names, dates of birth, insurance information, and treating physicians. For some patients, the PHI included the name of an infusion drug, and for Medicare patients, it included their social security numbers. To prevent a similar breach from happening in the future, the CE provided additional shred bins throughout the office, briefed all their employees on the incident, and advised them on best practices for handling and disposing of PHI. Additionally, the CE provided sanctions and retraining for the clerk responsible for the breach. In response to OCR’s investigation, the CE reviewed its data retention and destruction policies. The CE provided breach notification HHS, affected individuals, and the media.