Decatur Health Systems

A CAT scan log binder containing protected health information (PHI) went missing from the covered entity (CE), Decatur Health Systems, sometime between July 22, 2016, and July 25, 2016. The breach affected 707 individuals and the types of PHI contained in the binder included patients’ names, dates of birth, exam dates, diagnoses, ordering providers, and x-ray exposure levels. The CE provided breach notification to HHS, affected individuals, and the media. It also reported the incident to the proper law enforcement authorities. In response to the breach the CE enhanced physical safeguards in every department. Additionally, the CE implemented new privacy and security practices and retrained staff on its HIPAA policies and procedures. The CE also revised its policy to clarify how patients and third parties can access PHI, including associated fees, and educated staff on the policy. OCR obtained documentation that the CE implemented the corrective actions noted above.